Location Hiding Architecture for Mitigating DDoS Attacks in SCADA Systems

Distributed Denial of Service (DDoS) attacks are posing an increasing threat to SCADA systems, which are the core infrastructure for power grids, water treatment, oil and gas pipelines, and many other critical infrastructure systems. The growing connectivity of such systems and their dependence on legacy communication protocols make them quite susceptible to large-scale disruptions. This paper introduces a novel Location Hiding Architecture (LHA) for the protection of SCADA systems to improve the security and availability by hiding the real network location of the interested entity. The proposed architecture employs a multi-layer proxy mechanism with two types of proxies - setup and data. The system design keeps the public access interface separate from the SCADA core and ensures that an attacker can never directly see critical assets, much less target them. With dynamic proxy allocation, hidden routing paths, and anycast-based proxy distribution, we achieve scalability, resilience, and fast removal of compromised nodes from the system. Furthermore, it has adaptive traffic filtering and controlled access for reducing bad interactions. Simulation results show that a proxy density of 0. 5% can successfully block more than 93% of the DDoS traffic even when malicious nodes constitute as much as 10% of the network. The presented LHA framework enables a strong, scalable, defensive layer to effectively secure modern SCADA against evolving cyber threats.