SCADA Network Topology Discovery via Passive ARP and Routing Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional methods for discovering network topology in SCADA systems are slow and inefficient, particularly in large networks, as they require scanning extensive IP address ranges and often fail to detect silent or inactive devices, leading to incomplete network mapping.
Innovation Solution
A method that employs hardware processors to discover Layer 3 and Layer 2 network topologies by examining routing protocols, using SNMP and Telnet login, and merging deduplicated results to identify routers, subnets, active, and silent devices, while classifying devices through fusion of SNMP, MAC, and traffic-flow analysis to ensure accurate and complete network mapping.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional scanning methods are used to discover network topology by scanning extensive IP address ranges, then network mapping can be performed, but discovery time becomes excessively long and efficiency deteriorates
Solution Approach 1:
The patent segments the network discovery process into multiple phases: Phase 1 uses routing protocol analysis to identify Layer 3 topology and candidate subnets; Phase 2 uses ARP table analysis to identify Layer 2 devices within those subnets. This segmentation allows the system to focus scanning efforts on specific IP ranges derived from routing information rather than scanning the entire IP address space, dramatically reducing discovery time while maintaining completeness.
Solution Approach 2:
The patent performs preliminary actions by analyzing routing protocol messages and ARP tables to pre-identify valid subnets and devices before conducting comprehensive discovery scans. The routing protocol analysis预先 determines which IP ranges contain active devices, and ARP table analysis预先 identifies devices that have recently been active, allowing the system to skip unnecessary scanning of inactive IP ranges.
2Measurement precision
If traditional scanning methods are used to discover network topology, then network mapping can be performed, but silent or inactive devices are often missed leading to incomplete mapping
Solution Approach 1:
The patent uses ARP tables as an intermediary data source to detect silent or inactive devices. ARP tables contain records of devices that have recently transmitted or received data, even if they are not currently responsive to discovery scans. By analyzing ARP tables from multiple routers and switches, the system can identify devices that traditional scanning methods would miss, including silent devices that maintain network presence without actively responding to probes.
Solution Approach 2:
The patent merges multiple data sources including routing protocol information, ARP tables from multiple devices, and subnet analysis to create a comprehensive device inventory. This merging approach allows the system to cross-reference information across different network layers and devices, ensuring that both active and silent devices are captured in the final network map.
3Measurement precision
If multiple discovery methods are combined to improve detection accuracy, then device identification improves, but system complexity increases
Solution Approach 1:
The patent segments the discovery system into distinct functional modules: a routing protocol analysis module that processes OSPF/ISIS messages, an ARP table collection module that gathers data from multiple devices, a subnet identification module that derives valid IP ranges, and a device classification module that synthesizes information from all sources. This modular segmentation makes the complex multi-method discovery process more manageable and easier to implement while maintaining high classification accuracy.
Data Source
AI summary
Systems and methods for discovery and mapping of industrial control and SCADA networks are described herein. The disclosed systems and methods help operators ensure the cyber security of their SCADA network through accurate discovery, fingerprinting and mapping the industrial control network map, including PLCs (Programmable Logic Controller) and RTUs (Remote Terminal Unit), using passive techniques.