Detection of DoS Attacks Using ARFIMA Modeling of GOOSE Communication in IEC 61850 Substations

Elbez, Ghada; Keller, Hubert B.; Bohara, Atul; Nahrstedt, Klara; Hagenmeyer, Veit

doi:10.3390/en13195176

Detection of DoS Attacks Using ARFIMA Modeling of GOOSE Communication in IEC 61850 Substations

Journal Article · Thu Oct 01 04:00:00 EDT 2020 · Energies

DOI:https://doi.org/10.3390/en13195176· OSTI ID:1850594

^[1]; ^[2]; ^[3]; Nahrstedt, Klara ^[3]; Hagenmeyer, Veit ^[2]

Karlsruhe Inst. of Technology (KIT) (Germany). Inst. of Automation and Applied Informatics (IAI); Karlsruhe Inst. of Technology (KIT) (Germany)
Karlsruhe Inst. of Technology (KIT) (Germany). Inst. of Automation and Applied Informatics (IAI)
Univ. of Illinois at Urbana-Champaign, IL (United States). Information Trust Institute (ITI)

Integration of Information and Communication Technology (ICT) in modern smart grids (SGs) offers many advantages including the use of renewables and an effective way to protect, control and monitor the energy transmission and distribution. To reach an optimal operation of future energy systems, availability, integrity and confidentiality of data should be guaranteed. Research on the cyber-physical security of electrical substations based on IEC 61850 is still at an early stage. In the present work, we first model the network traffic data in electrical substations, then, we present a statistical Anomaly Detection (AD) method to detect Denial of Service (DoS) attacks against the Generic Object Oriented Substation Event (GOOSE) network communication. According to interpretations on the self-similarity and the Long-Range Dependency (LRD) of the data, an Auto-Regressive Fractionally Integrated Moving Average (ARFIMA) model was shown to describe well the GOOSE communication in the substation process network. Based on this ARFIMA-model and in view of cyber-physical security, an effective model-based AD method is developed and analyzed. Two variants of the statistical AD considering statistical hypothesis testing based on the Generalized Likelihood Ratio Test (GLRT) and the cumulative sum (CUSUM) are presented to detect flooding attacks that might affect the availability of the data. Our work presents a novel AD method, with two different variants, tailored to the specific features of the GOOSE traffic in IEC 61850 substations. The statistical AD is capable of detecting anomalies at unknown change times under the realistic assumption of unknown model parameters. The performance of both variants of the AD method is validated and assessed using data collected from a simulation case study. We perform several Monte-Carlo simulations under different noise variances. The detection delay is provided for each detector and it represents the number of discrete time samples after which an anomaly is detected. In fact, our statistical AD method with both variants (CUSUM and GLRT) has around half the false positive rate and a smaller detection delay when compared with two of the closest works found in the literature. Our AD approach based on the GLRT detector has the smallest false positive rate among all considered approaches. Whereas, our AD approach based on the CUSUM test has the lowest false negative rate thus the best detection rate. Depending on the requirements as well as the costs of false alarms or missed anomalies, both variants of our statistical detection method can be used and are further analyzed using composite detection metrics.

View Accepted Manuscript (DOE)

Research Organization:: Univ. of Illinois at Urbana-Champaign, IL (United States)

Sponsoring Organization:: USDOE Office of Electricity Delivery and Energy Reliability (OE); Helmholtz Programm Energieeffizienz, Materialien und Ressourcen EMR; Kastel BMBF Projekt Sicherheit kritischer Infrastrukturen SKI; BMBF Energiesystem 2050; Karlsruhe House of Young Scientists (KHYS)

Grant/Contract Number:: OE0000780

OSTI ID:: 1850594

Journal Information:: Energies, Journal Name: Energies Journal Issue: 19 Vol. 13; ISSN 1996-1073; ISSN ENERGA

Publisher:: MDPICopyright Statement

Country of Publication:: United States

Language:: English

References (25)

Intrusion detection algorithm based on OCSVM in industrial control system: Intrusion detection algorithm based on OCSVM Shang, Wenli; Zeng, Peng; Wan, Ming Security and Communication Networks, Vol. 9, Issue 10 https://doi.org/10.1002/sec.1398	journal	December 2015
The historically adjusted range and the historically rescaled adjusted range Lloyd, E. H.; Warren, D. Stochastic Hydrology and Hydraulics, Vol. 2, Issue 3 https://doi.org/10.1007/BF01550840	journal	September 1988
Detecting changes in signals and systems—A survey Basseville, Michèle Automatica, Vol. 24, Issue 3 https://doi.org/10.1016/0005-1098(88)90073-8	journal	May 1988
Data Traffic Characterization in Intelligent Electric Substations using FARIMA based Threshold Model Hao, Weijie; Yang, Qiang Energy Procedia, Vol. 145 https://doi.org/10.1016/j.egypro.2018.04.068	journal	July 2018
Challenges and research directions for heterogeneous cyber–physical system based on IEC 61850: Vulnerabilities, security requirements, and security architecture Yoo, Hyunguk; Shon, Taeshik Future Generation Computer Systems, Vol. 61 https://doi.org/10.1016/j.future.2015.09.026	journal	August 2016
Time-series Modelling of IEC 61850 GOOSE Communication Traffic between IEDs in smart grids - a parametric analysis Feizimirkhani, R.; Bratcu, A. I.; Bésanger, Y. IFAC-PapersOnLine, Vol. 51, Issue 28 https://doi.org/10.1016/j.ifacol.2018.11.743	journal	January 2018
FARIMA model‐based communication traffic anomaly detection in intelligent electric power substations Yang, Qiang; Hao, Weijie; Ge, Leijiao IET Cyber-Physical Systems: Theory & Applications, Vol. 4, Issue 1 https://doi.org/10.1049/iet-cps.2018.5052	journal	December 2018
Long-Term Storage Capacity of Reservoirs Hurst, H. E. Transactions of the American Society of Civil Engineers, Vol. 116, Issue 1 https://doi.org/10.1061/TACEAT.0006518	journal	January 1951
Continuous Inspection Schemes Page, E. S. Biometrika, Vol. 41, Issue 1-2 https://doi.org/10.1093/biomet/41.1-2.100	journal	January 1954
On the self-similar nature of Ethernet traffic (extended version) Leland, W. E.; Taqqu, M. S.; Willinger, W. IEEE/ACM Transactions on Networking, Vol. 2, Issue 1 https://doi.org/10.1109/90.282603	journal	January 1994
Self-similarity through high-variability: statistical analysis of Ethernet LAN traffic at the source level Willinger, W.; Taqqu, M. S.; Sherman, R. IEEE/ACM Transactions on Networking, Vol. 5, Issue 1 https://doi.org/10.1109/90.554723	journal	January 1997
Difficulties in simulating the Internet Floyd, S.; Paxson, V. IEEE/ACM Transactions on Networking, Vol. 9, Issue 4 https://doi.org/10.1109/90.944338	journal	January 2001
A Novel Scheme for Performance Evaluation of an IEC 61850-Based Active Distribution System Substation Ustun, Taha Selim; Aftab, Mohd Asim; Ali, Ikbal IEEE Access, Vol. 7 https://doi.org/10.1109/ACCESS.2019.2937971	journal	January 2019
Modeling and Simulation of Data Flow for VLAN-Based Communication in Substations Zhang, Zhidan; Huang, Xiaoqing; Keune, Bjorn IEEE Systems Journal, Vol. 11, Issue 4 https://doi.org/10.1109/JSYST.2015.2428058	journal	December 2017
A Multidimensional Critical State Analysis for Detecting Intrusions in SCADA Systems Carcano, A.; Coletta, A.; Guglielmi, M. IEEE Transactions on Industrial Informatics, Vol. 7, Issue 2 https://doi.org/10.1109/TII.2010.2099234	journal	May 2011
An Intrusion Detection System for IEC61850 Automated Substations Premaratne, Upeka Kanchana; Samarabandu, Jagath; Sidhu, Tarlochan S. IEEE Transactions on Power Delivery, Vol. 25, Issue 4 https://doi.org/10.1109/TPWRD.2010.2050076	journal	October 2010
Multidimensional Intrusion Detection System for IEC 61850-Based SCADA Networks Yang, Yi; Xu, Hai-Qing; Gao, Lei IEEE Transactions on Power Delivery, Vol. 32, Issue 2 https://doi.org/10.1109/TPWRD.2016.2603339	journal	April 2017
Integrated Anomaly Detection for Cyber Security of the Substations Hong, Junho; Liu, Chen-Ching; Govindarasu, Manimaran IEEE Transactions on Smart Grid, Vol. 5, Issue 4 https://doi.org/10.1109/TSG.2013.2294473	journal	July 2014
Fractional Differencing Modeling in Hydrology Hosking, J. R. M. Journal of the American Water Resources Association, Vol. 21, Issue 4 https://doi.org/10.1111/j.1752-1688.1985.tb05382.x	journal	August 1985
Evaluating Computer Intrusion Detection Systems: A Survey of Common Practices Milenkoski, Aleksandar; Vieira, Marco; Kounev, Samuel ACM Computing Surveys, Vol. 48, Issue 1 https://doi.org/10.1145/2808691	journal	September 2015
Large-Sample Properties of Parameter Estimates for Strongly Dependent Stationary Gaussian Time Series Fox, Robert; Taqqu, Murad S. The Annals of Statistics, Vol. 14, Issue 2 https://doi.org/10.1214/aos/1176349936	journal	June 1986
Zuverlässige und sichere Software offener Automatisierungssysteme der Zukunft – Herausforderungen und Lösungswege Keller, Hubert B.; Schneider, Oliver; Matthes, Jörg at - Automatisierungstechnik, Vol. 64, Issue 12 https://doi.org/10.1515/auto-2016-0060	journal	November 2016
A Generalized ARFIMA Model with Smooth Transition Fractional Integration Parameter Boubaker, Heni Journal of Time Series Econometrics, Vol. 10, Issue 1 https://doi.org/10.1515/jtse-2015-0001	journal	July 2017
Space-Time Modelling with Long-Memory Dependence: Assessing Ireland's Wind Power Resource Haslett, John; Raftery, Adrian E. Applied Statistics, Vol. 38, Issue 1 https://doi.org/10.2307/2347679	journal	January 1989
Sensor Reliability in Cyber-Physical Systems Using Internet-of-Things Data: A Review and Case Study Castaño, Fernando; Strzelczak, Stanisław; Villalonga, Alberto Remote Sensing, Vol. 11, Issue 19 https://doi.org/10.3390/rs11192252	journal	September 2019

Similar Records

IEC 61850: Technology Standards and Cyber-Security Threats

Conference · Wed Jun 08 00:00:00 EDT 2016 · OSTI ID:1341353

Alerga: Alert Aggregation and Reasoning in GOOSE Simulation Pipeline

Conference · Tue Dec 05 23:00:00 EST 2023 · OSTI ID:2293497

Data-Centric Communication Framework for Multicast IEC 61850 Routable GOOSE Messages over the WAN in Modern Power Systems

Journal Article · Fri Jan 24 23:00:00 EST 2020 · Applied Sciences · OSTI ID:1801316

Related Subjects

IEC 61850 electrical substations
97 MATHEMATICS AND COMPUTING
ARFIMA model
DoS attacks
Energy & Fuels
cyber-physical security
intrusion detection
model-based anomaly detection
substation communication network

Detection of DoS Attacks Using ARFIMA Modeling of GOOSE Communication in IEC 61850 Substations

Citation Formats

References (25)

Similar Records

Related Subjects