Man-in-the-Middle Attack Against a Network Control System: Practical Implementation and Detection

A Man-in-the-Middle (MITM) attack is a cyber-attack in which the attacker covertly intercepts and passes messages between two parties who mistakenly think they are communicating directly. However, in reality, the attacker intercepts data transfers between a client and a server by deceiving both parties. While the attack occurs, the data is secretly manipulated by inserting false information. This article explores how to create and use MITM attacks in a liquid-level networked control system. The essential tools to execute the attack include Ettercap and Wireshark software applications. Ettercap is a tool for capturing packets, allowing real-time redirection and modification of data streams by writing the packets back onto the network. Wireshark is a flexible network protocol analyzer used to analyze data packets of the networked control system. After implementing the MITM attack on the cyber-physical system, system data was collected and labeled to detect MITM attacks by leveraging machine learning classification algorithms.