Distributed Intrusion Detection System using Semantic-based Rules for SCADA in Smart Grid
Cyber-physical system (CPS) security for the smart grid enables secure communication for the SCADA and wide-area measurement system data. Power utilities world-wide use various SCADA protocols, namely DNP3, Modbus, and IEC 61850, for the data exchanges across substation field devices, remote terminal units (RTUs), and control center applications. Adversaries may exploit compromised SCADA protocols for the reconnaissance, data exfiltration, vulnerability assessment, and injection of stealthy cyberattacks to affect power system operation. In this paper, we propose an efficient algorithm to generate robust rule sets. We integrate the rule sets into an intrusion detection system (IDS), which continuously monitors the DNP3 data traffic at a substation network and detects intrusions and anomalies in real-time. To enable CPS-aware wide-area situational awareness, we integrated the methodology into an open-source distributed-IDS (D-IDS) framework. The D-IDS facilitates central monitoring of the detected anomalies from the geographically distributed substations and to the control center. The proposed algorithm provides an optimal solution to detect network intrusions and abnormal behavior. Different types of IDS rules based on packet payload, packet flow, and time threshold are generated. Further, IDS testing and evaluation is performed with a set of rules in different sequences. The detection time is measured for different IDS rules, and the results are plotted. All the experiments are conducted at Power Cyber Lab, Iowa State University, for multiple power grid models. After successful testing and evaluation, knowledge and implementation are transferred to field deployment.
- Research Organization:
- Iowa State Univ., Ames, IA (United States)
- Sponsoring Organization:
- USDOE
- Contributing Organization:
- Iowa State University
- DOE Contract Number:
- OE0000830
- OSTI ID:
- 1985672
- Report Number(s):
- DOE-ISU-0000830-10
- Journal Information:
- 2020 IEEE/PES Transmission and Distribution Conference and Exposition (T&D), Conference: 2020 IEEE/PES Transmission and Distribution Conference and Exposition (T&D)
- Country of Publication:
- United States
- Language:
- English
Taxonomy of attacks on industrial control protocols
|
conference | July 2015 |
The real story of stuxnet
|
journal | March 2013 |
Cyber-Physical Security Testbeds: Architecture, Application, and Evaluation for Smart Grid
|
journal | June 2013 |
High Availability for Network Management Applications
|
conference | January 2007 |
Similar Records
Oak Ridge National Laboratory Pilot Demonstration of an Attestation and Anomaly Detection Framework using Distributed Ledger Technology for Power Grid Infrastructure
Attack-resilient algorithms and testbed federation for wide-area protection and control in smart grid