Alerga: Alert Aggregation and Reasoning in GOOSE Simulation Pipeline

Conference · Wed Dec 06 04:00:00 EST 2023

DOI:https://doi.org/10.1109/SmartGridComm57358.2023.10333915· OSTI ID:2293497

Battista, Jude; Nahrstedt, Klara; Valdes, Alfonso; McFly, Shane

IEC 61850 specifies the Generic Object Oriented Substation Event (GOOSE) protocol as one option for low latency communication of substation-related events. Due to its strict timing requirements, GOOSE lacks any form of encryption or authentication and has only minimal integrity guarantees. These absences render the protocol vulnerable to a variety of communication anomalies, including adversarial action. In particular, an adversary with access to the substation network can launch man in the middle (MITM) attacks. We propose Alerga, a set of tools to allow operators to mitigate some of the risks of the protocol while retaining its strengths. To that end, we have developed first a GOOSE simulation pipeline including data generation, anomaly detection, alert handling, causal reasoning and data visualization components. The simulator is designed to be modular, allowing operators to swap components to better fit their network capabilities. The volume of alert traffic on a substation network threatens operators with alert fatigue. In order to combat this, we secondly present a novel form of alert aggregation and processing, offering operators a condensed view of any threats to the system. Thirdly, to facilitate the handling of these threats, our causal reasoning system traces the alerts back to their most likely cause, generating an initial hypothesis for operators to investigate.

• Research Organization: National Renewable Energy Laboratory (NREL), Golden, CO (United States)
• Sponsoring Organization: U.S. Department of Energy (DOE)
• DOE Contract Number: AC36-08GO28308
• OSTI ID: 2293497
• Report Number(s): NREL/CP-5T00-88766; MainId:89545; UUID:1a06be3a-c786-42fc-96ce-e7d8bd0d0094; MainAdminId:71774
• Country of Publication: United States
• Language: English

Related Subjects

GOOSE
MATHEMATICS AND COMPUTING
alert aggregation
causal reasoning
network simulation