On Specification-based Cyber-Attack Detection in Smart Grids
arXiv:2209.04354 · doi:10.1186/s42162-022-00206-7
Abstract
The transformation of power grids into intelligent cyber-physical systems brings numerous benefits, but also significantly increases the surface for cyber-attacks, demanding appropriate countermeasures. However, the development, validation, and testing of data-driven countermeasures against cyber-attacks, such as machine learning-based detection approaches, lack important data from real-world cyber incidents. Unlike attack data from real-world cyber incidents, infrastructure knowledge and standards are accessible through expert and domain knowledge. Our proposed approach uses domain knowledge to define the behavior of a smart grid under non-attack conditions and detect attack patterns and anomalies. Using a graph-based specification formalism, we combine cross-domain knowledge that enables the generation of whitelisting rules not only for statically defined protocol fields but also for communication ows and technical operation boundaries. Finally, we evaluate our specification-based intrusion detection system against various attack scenarios and assess detection quality and performance. In particular, we investigate a data manipulation attack in a future-orientated use case of an IEC 60870-based SCADA system that controls distributed energy resources in the distribution grid. Our approach can detect severe data manipulation attacks with high accuracy in a timely and reliable manner.
References in corpus (7)
- Machine Learning Based Intrusion Detection Systems for IoT Applications
- Measuring the Quality of Explanations: The System Causability Scale (SCS). Comparing Human and Machine Explanations
- Distributed Intrusion Detection System using Semantic-based Rules for SCADA in Smart Grid
- Methods for Actors in the Electric Power System to Prevent, Detect and React to ICT Attacks and Failures
- A False Sense of Security? Revisiting the State of Machine Learning-Based Industrial Intrusion Detection
- Graph-based Model of Smart Grid Architectures
- Towards an Approach to Contextual Detection of Multi-Stage Cyber Attacks in Smart Grids