IEC61850Bean Attacks & Defenses

Updated 26 February 2026

IEC61850Bean-based attacks are a class of adversarial activities that manipulate MMS commands in substations to trigger unauthorized state changes.
The attack workflow involves reconnaissance, state readout, and malicious write operations, effectively bypassing conventional network defenses.
A real-time detection system leveraging protocol field whitelists achieved 100% accuracy with minimal latency, validating its effectiveness in substation security.

IEC61850Bean-based attacks are a class of adversarial activities targeting the Manufacturing Message Specification (MMS) layer of IEC 61850-based substations. Exploiting semantic weaknesses in application-layer protocols rather than lower-level network anomalies, these attacks are typically perpetrated using open-source toolkits (e.g., IEC61850bean, libiec61850) to generate protocol-compliant but operationally malicious MMS traffic. Such attacks can trigger unauthorized state changes in field IEDs and PLCs (including circuit breaker operations) even when the traffic cannot be distinguished from legitimate SCADA-MMS exchanges by conventional network or transport-layer defenses (Maganti et al., 7 Jan 2026).

1. Attack Workflow and Characteristics

IEC61850Bean-based attacks exploit the trust between SCADA hosts and field devices in substations by injecting MMS packets encoded correctly at the ASN.1/BER-TLV level over TCP (port 102). The canonical attack flow encompasses:

Reconnaissance: Use of getNameList and getVariableAccessAttributes MMS services to enumerate logical devices and accessible node/attribute combinations.
State Readout: Submission of read requests (service tag 4) to harvest current process state.
Malicious Write: Execution of write requests (service tag 5) with crafted Oper structs targeting critical operation controls (e.g., GGIO12$CO$SPCSO$Oper for breaker manipulation).
Obfuscation: Manipulation of auxiliary fields such as timeAccuracy and omitting/altering origin.orIdent, leveraging the lack of application-layer authentication in standard MMS implementations.

The attack state machine consists of TCP/COTP session establishment, iterative Confirmed-Request/Confirmed-Response cycles, and strategic sequencing to avoid or bypass role-based access checks. As MMS does not enforce per-packet authentication or authorize based on user credentials at the application, any ASN.1-compliant payload is processed by the automation controller if it satisfies syntax and basic structure (Maganti et al., 7 Jan 2026).

2. Detection Methodologies and Feature Extraction

A deterministic, protocol-aware detection approach is necessary to counter these attacks, hinging on extracting and cross-referencing specific fields from MMS PDUs:

Extracted fields per packet include service type, domainId (logical device), itemId (logical node/object/attribute), timeAccuracy, and octet-string payload from writes.
Dual whitelists are learned from benign operational traffic for MMS read and write transactions:
- $W_{read} = \{(\text{domainId},\text{itemId})\ |\ \text{service}=4\}$
- $W_{write} = \{(\text{domainId},\text{itemId},\text{timeAccuracy},\text{octetString})\ |\ \text{service}=5\}$
Per-packet mismatch indicators
- $\Delta_{read}(F) = 0$ if $(f_4,f_5)\in W_{read}$ , else 1
- $\Delta_{write}(F) = 0$ if $(f_4,f_5,f_6,f_7)\in W_{write}$ , else 1

Any MMS packet not matching the observed whitelists is flagged as out-of-profile and indicative of attack (Maganti et al., 7 Jan 2026).

3. Real-Time Automated Detection and Prevention Pipeline

The defense is implemented as a multi-module real-time pipeline with the following core logic:

for each TCP port 102 packet p:
    parse MMS PDU, extract F = (f₃, f₄, f₅, f₆, f₇)
    if f₃ == 4:  # Read
        if Δ_read(F) == 1:
            flag_as_attack(p)
    elif f₃ == 5:  # Write
        if Δ_write(F) == 1:
            flag_as_attack(p)
    else:
        pass  # Non-read/write

Upon detection, a new NIDS signature matching the five-tuple (service, domainId, itemId, timeAccuracy, octetString) is auto-generated and deployed to a signature-based defense (e.g., Snort, Suricata), running inline in IPS mode. This setup enables drop actions for all future packets matching malicious characteristics, enforcing an "authorized user, authorized operation" regime without deep packet inspection or decryption (Maganti et al., 7 Jan 2026).

4. Experimental Evaluation

Validation was performed on the iTrust EPIC testbed across seven datasets, including benign and multiple attack scenarios. Attack traffic was generated using both IEC61850Bean scripts and C code leveraging libiec61850, targeting known operational states:

Dataset	Description	Attack Presence
D1–D4, D7	Benign scenarios and normal operations	None
D5, D6	Malicious script/code (operate attacks)	Active attacks

Results across 36.5 million benign packets and 154 attack packets yielded:

Accuracy: 100.00%
Precision: 1.000
Recall: 1.000
FPR: 0.000

Processing latency from packet arrival to block remained at 0.8 ms (4-core x86 host at 10,000 pkts/s), with new NIDS rules synthesized in under 15 ms per novel signature. No false positives occurred in legitimate traffic (Maganti et al., 7 Jan 2026).

5. Distinction from GOOSE and SV Attacks

While GOOSE- and SV-based attacks exploit protocol-specific weaknesses at the process bus (multicast, real-time traffic), IEC61850Bean-based (MMS-layer) attacks operate over TCP and target station bus automation via flexible device control:

GOOSE attacks: Manipulate state by injecting or replaying Layer 2 events (e.g., breaker trip, state transitions), countered by MAC-based authentication (IEC 62351), sequence/timing semantic IDS, and hybrid architectures (Herath et al., 24 Nov 2025).
SV attacks: Target measurement integrity by injecting or replaying sampled values; countered via latency modeling, EMG-distribution tracking, replay and timing checks, and deep learning-based source localization (Cibin et al., 1 Jul 2025).
MMS attacks (IEC61850Bean-based): Abuse authenticated but semantically unconstrained station-layer commands to issue unauthorized state changes through script- or code-driven automation (Maganti et al., 7 Jan 2026).

A comprehensive substation defense strategy must thus span process and station bus analytics and operate at semantic, temporal, and cryptographic levels.

6. Limitations and Mitigation Challenges

Identified constraints and future research needs include:

Signature-based defenses require a training phase and do not catch new attack types that precisely mimic previously observed benign tuples.
MMS application-layer defenses cannot prevent attacks exploiting out-of-band access or misconfiguration in operational field devices.
Attack prevention efficacy depends on tight coupling between real-time signature synthesis and inline packet filtering to maintain operational determinism.
Suggested enhancements include integration with broader SDN-based flow control for network-level quarantine and coordinated use with process-level anomaly detection (e.g., rule- or autoencoder-based GOOSE/SV IDS) for layered defense (Herath et al., 24 Nov 2025).

7. Summary Table: IEC61850Bean Attack Defense Performance

Metric	Value (Testbed)
Detection Accuracy	100.00%
False Positives	0.000
Average Latency	0.8 ms/packet
Max Rule Synthesis	<15 ms

These findings establish the effectiveness of field-value–aware, real-time defense frameworks against IEC61850Bean-based attacks, supporting substation automation integrity and resiliency against automated protocol-abuse at the MMS layer (Maganti et al., 7 Jan 2026).