Search papers, labs, and topics across Lattice.
This study enhances attack detection in BACnet/IP networks by modifying CISA's Zeek BACnet parser to generate a comprehensive per-packet log, facilitating machine-learning feature engineering. A simulated BACnet/IP testbed was created to model a commercial HVAC system, allowing for the evaluation of five unsupervised anomaly detection models against various BACnet attack types. The findings reveal that the One-Class SVM model outperformed others with an average F1 score of 0.864, particularly excelling in detecting high-volume attacks like denial-of-service and reconnaissance.
One-Class SVM achieves an impressive average F1 score of 0.864 in detecting BACnet/IP attacks, highlighting significant vulnerabilities in building automation systems.
Building Automation Systems (BAS) manage critical building functions using protocols such as BACnet/IP, yet defenders have limited tooling and few labeled datasets for detecting BACnet-specific attacks. This work addresses these gaps through three contributions. First, CISA's Zeek BACnet parser is modified to produce a unified per-packet log, simplifying feature engineering for machine-learning (ML) pipelines. Second, a simulated BACnet/IP testbed is developed using bacpypes3 to model a small commercial HVAC system with physics-based device behavior, schedule-aware controller logic, and per-packet attack labeling. Third, five unsupervised anomaly detection models are evaluated using baseline traffic and six BACnet attack types, including denial of service, reconnaissance, property tampering, and false data injection. Results show that One-Class SVM achieved the strongest overall performance, with an average F1 score of 0.864 across all attacks and F1 scores above 0.99 for high-volume denial-of-service and reconnaissance attacks. Detection is much stronger for high-volume attacks, such as DoS attacks and reconnaissance, than stealthier techniques such as tampering and false data injection, which scored around 77%.
