Distributed Intrusion Detection System using Semantic-based Rules for SCADA in Smart Grid
- Iowa State Univ., Ames, IA (United States); Iowa State University
- Iowa State Univ., Ames, IA (United States)
Cyber-physical system (CPS) security for the smart grid enables secure communication for the SCADA and wide-area measurement system data. Power utilities world-wide use various SCADA protocols, namely DNP3, Modbus, and IEC 61850, for the data exchanges across substation field devices, remote terminal units (RTUs), and control center applications. Adversaries may exploit compromised SCADA protocols for the reconnaissance, data exfiltration, vulnerability assessment, and injection of stealthy cyberattacks to affect power system operation. In this paper, we propose an efficient algorithm to generate robust rule sets. We integrate the rule sets into an intrusion detection system (IDS), which continuously monitors the DNP3 data traffic at a substation network and detects intrusions and anomalies in real-time. To enable CPS-aware wide-area situational awareness, we integrated the methodology into an open-source distributed-IDS (D-IDS) framework. The D-IDS facilitates central monitoring of the detected anomalies from the geographically distributed substations and to the control center. The proposed algorithm provides an optimal solution to detect network intrusions and abnormal behavior. Different types of IDS rules based on packet payload, packet flow, and time threshold are generated. Further, IDS testing and evaluation is performed with a set of rules in different sequences. The detection time is measured for different IDS rules, and the results are plotted. All the experiments are conducted at Power Cyber Lab, Iowa State University, for multiple power grid models. After successful testing and evaluation, knowledge and implementation are transferred to field deployment.
- Research Organization:
- Iowa State University
- Sponsoring Organization:
- U.S. Department of Energy
- Contributing Organization:
- Iowa State University
- DOE Contract Number:
- OE0000830
- OSTI ID:
- 1985672
- Report Number(s):
- DOE-ISU-0000830-10
- Journal Information:
- 2020 IEEE/PES Transmission and Distribution Conference and Exposition (T&D), Journal Name: 2020 IEEE/PES Transmission and Distribution Conference and Exposition (T&D)
- Country of Publication:
- United States
- Language:
- English
Cyber-Physical Security Testbeds: Architecture, Application, and Evaluation for Smart Grid
|
journal | June 2013 |
High Availability for Network Management Applications
|
conference | January 2007 |
The real story of stuxnet
|
journal | March 2013 |
Taxonomy of attacks on industrial control protocols
|
conference | July 2015 |
Similar Records
Testbed-based Evaluation of SIEM Tool for Cyber Kill Chain Model in Power Grid SCADA System
CPS Testbed Architectures for WAMPAC using Industrial Substation and Control Center Platforms and Attack-Defense Evaluation