Cyber intrusions to substations of a power grid are a source of vulnerability since most substations are unmanned and with limited protection of the physical security. In the worst case, simultaneous intrusions into multiple substations can lead to severe cascading events, causing catastrophic power outages. In this paper, an integrated Anomaly Detection System (ADS) is proposed which contains host- and network-based anomaly detection systems for the substations, and simultaneous anomaly detection for multiple substations. Potential scenarios of simultaneous intrusions into the substations have been simulated using a substation automation testbed. The host-based anomaly detection considers temporal anomalies in the substation facilities, e.g., user-interfaces, Intelligent Electronic Devices (IEDs) and circuit breakers. The malicious behaviors of substation automation based on multicast messages, e.g., Generic Object Oriented Substation Event (GOOSE) and Sampled Measured Value (SMV), are incorporated in the proposed network-based anomaly detection. The proposed simultaneous intrusion detection method is able to identify the same type of attacks at multiple substations and their locations. The result is a new integrated tool for detection and mitigation of cyber intrusions at a single substation or multiple substations of a power grid.

Integrated Anomaly Detection for Cyber Security of the Substations

© 2014 The Science and Information (SAI) Organization.In this paper we present a intrusion detection module capable of detecting malicious network traffic in a SCADA (Supervisory Control and Data Acquisition) system. Malicious data in a SCADA system disrupt its correct functioning and tamper with its normal operation. OCSVM (One-Class Support Vector Machine) is an intrusion detection mechanism that does not need any labeled data for training or any information about the kind of anomaly is expecting for the detection process. This feature makes it ideal for processing SCADA environment data and automate SCADA performance monitoring. The OCSVM module developed is trained by network traces off line and detect anomalies in the system real time. The module is part of an IDS (Intrusion Detection System) system developed under CockpitCI project and communicates with the other parts of the system by the exchange of IDMEF (Intrusion Detection Message Exchange Format) messages that carry information about the source of the incident, the time and a classification of the alarm.

/pdf/intrusion-detection-in-scada-systems-using-machine-learning-257fqp777o.pdf

Intrusion detection in SCADA systems using machine learning techniques

The smart grid is an innovative energy network that will improve the conventional electrical grid network to be more reliable, cooperative, responsive, and economical. Within the context of the new capabilities, advanced data sensing, communication, and networking technology will play a significant role in shaping the future of the smart grid. The smart grid will require a flexible and efficient framework to ensure the collection of timely and accurate information from various locations in power grid to provide continuous and reliable operation. This article presents a tutorial on the sensor data collection, communications, and networking issues for the smart grid. First, the applications of data sensing in the smart grid are reviewed. Then, the requirements for data sensing and collection, the corresponding sensors and actuators, and the communication and networking architecture are discussed. The communication technologies and the data communication network architecture and protocols for the smart grid are described. Next, different emerging techniques for data sensing, communications, and sensor data networking are reviewed. The issues related to security of data sensing and communications in the smart grid are then discussed. To this end, the standardization activities and use cases related to data sensing and communications in the smart grid are summarized. Finally, several open issues and challenges are outlined. Copyright © 2012 John Wiley & Sons, Ltd.

/pdf/smart-grid-sensor-data-collection-communication-and-4g8dtu7bfl.pdf

Smart grid sensor data collection, communication, and networking: a tutorial

This paper presents a distributed intrusion detection system (DIDS) for supervisory control and data acquisition (SCADA) industrial control systems, which was developed for the CockpitCI project. Its architecture was designed to address the specific characteristics and requirements for SCADA cybersecurity that cannot be adequately fulfilled by techniques from the information technology world, thus requiring a domain-specific approach. DIDS components are described in terms of their functionality, operation, integration, and management. Moreover, system evaluation and validation are undertaken within an especially designed hybrid testbed emulating the SCADA system for an electrical distribution grid.

A Cybersecurity Detection Framework for Supervisory Control and Data Acquisition Systems

With the ongoing adoption of remotely communicating and interacting control systems harbored by critical infrastructures, the potential attack surface of such systems also increases drastically. Therefore, not only the need for standardized and manufacturer-agnostic control system communication protocols has grown, but also the requirement to protect those control systems’ communication. There have already been numerous security analyses of different control system communication protocols; yet, these have not been combined with each other sufficiently, mainly due to three reasons: First, the life cycles of such protocols are usually much longer than those of other Internet and communication technologies, therefore legacy protocols are often not considered in current security analyses. Second, the usage of certain control system communication protocols is usually restricted to a particular infrastructure domain, which leads to an isolated view on them. Third, with the accelerating pace at which both control system communication protocols and threats against them develop, existing surveys are aging at an increased rate, making their re-investigation a necessity. In this paper, a comprehensive survey on the security of the most important control system communication protocols, namely Modbus, OPC UA, TASE.2, DNP3, IEC 60870-5-101, IEC 60870-5-104, and IEC 61850 is performed. To achieve comparability, a common test methodology based on attacks exploiting well-known control system protocol vulnerabilities is created for all protocols. In addition, the effectiveness of the related security standard IEC 62351 is analyzed by a pre- and post-IEC 62351 comparison.

Security Challenges in Control Network Protocols: A Survey

Achieving all-encompassing component-level security in power system IT infrastructures is difficult, owing to its cost and potential performance implications.

/pdf/challenges-in-power-system-information-security-cs5t8q6ieg.pdf

rgy D #x E

Papers

Challenges in Power System Information Security