Paper accepted at TENSOR
10 June 2023, by Mathias Fischer
Photo: https://networking.ifip.org/2023/
Our paper, ”TSNZeek: An Open-source Intrusion Detection System for IEEE 802.1 Time-sensitive Networking” was accepted for publication at the 3rd International Workshop on Time-Sensitive and Deterministic Networking (TENSOR), co-located with IFIP NETWORKING'23.
In this paper, we design the first open-source intrusion detection mechanism for IEEE 802.1 Time-sensitive Networking (TSN) protocols by extending a popular security monitoring tool, Zeek.
We will present our results at the workshop in Barcelona in June 2023 and seek an exchange with international researchers.
Paper Abstract:
IEEE 802.1 Time-sensitive Networking (TSN) standards are envisioned to replace legacy network protocols in critical domains to ensure reliable and deterministic communication over off-the-shelf Ethernet equipment. However, they lack security countermeasures and can even impose new attack vectors that may lead to hazardous consequences. This paper presents the first open-source security monitoring and intrusion detection mechanism, TSNZeek, for IEEE 802.1 TSN protocols. We extend an existing monitoring tool, Zeek, with a new packet parsing grammar to process TSN data traffic and a rule-based attack detection engine for TSN-specific threats. We also discuss various security-related configuration and design aspects for IEEE 802.1 TSN monitoring. Our experiments show that TSNZeek causes only ~5% CPU overhead on top of Zeek and successfully detects various threats in a real TSN testbed.