IEEE 802.1 Time-sensitive Networking~(TSN) standards are envisioned to replace legacy network protocols in critical domains to ensure reliable and deterministic communication over off-the-shelf Ethernet equipment. However, they lack security countermeasures and can even impose new attack vectors that may lead to hazardous consequences. This paper presents the first open-source security monitoring and intrusion detection mechanism, TSNZeek, for IEEE 802.1 TSN protocols. We extend an existing monitoring tool, Zeek, with a new packet parsing grammar to process TSN data traffic and a rule-based attack detection engine for TSN-specific threats. We also discuss various security-related configuration and design aspects for IEEE 802.1 TSN monitoring. Our experiments show that TSNZeek causes only ~5% CPU overhead on top of Zeek and successfully detects various threats in a real TSN testbed.

翻译：IEEE 802.1时间敏感网络（TSN）标准被设想用于替代关键领域的传统网络协议，以在商用以太网设备上实现可靠且确定性的通信。然而，这些标准缺乏安全对策，甚至可能引入新的攻击向量，从而导致危险后果。本文提出了首个面向IEEE 802.1 TSN协议的开源安全监控与入侵检测机制——TSNZeek。我们通过新的数据包解析语法扩展了现有监控工具Zeek，以处理TSN数据流量，并构建了基于规则的攻击检测引擎，用于识别TSN特定威胁。此外，本文还讨论了IEEE 802.1 TSN监控在安全相关的配置与设计方面的问题。实验结果表明，TSNZeek在Zeek基础上仅增加约5%的CPU开销，并能在真实TSN测试平台上成功检测多种威胁。