Alerga: Alert Aggregation and Reasoning in GOOSE Simulation Pipeline
IEC 61850 specifies the Generic Object Oriented Substation Event (GOOSE) protocol as one option for low latency communication of substation-related events. Due to its strict timing requirements, GOOSE lacks any form of encryption or authentication and has only minimal integrity guarantees. These absences render the protocol vulnerable to a variety of communication anomalies, including adversarial action. In particular, an adversary with access to the substation network can launch man in the middle (MITM) attacks. We propose Alerga, a set of tools to allow operators to mitigate some of the risks of the protocol while retaining its strengths. To that end, we have developed first a GOOSE simulation pipeline including data generation, anomaly detection, alert handling, causal reasoning and data visualization components. The simulator is designed to be modular, allowing operators to swap components to better fit their network capabilities. The volume of alert traffic on a substation network threatens operators with alert fatigue. In order to combat this, we secondly present a novel form of alert aggregation and processing, offering operators a condensed view of any threats to the system. Thirdly, to facilitate the handling of these threats, our causal reasoning system traces the alerts back to their most likely cause, generating an initial hypothesis for operators to investigate.
- Research Organization:
- National Renewable Energy Laboratory (NREL), Golden, CO (United States)
- Sponsoring Organization:
- U.S. Department of Energy (DOE)
- DOE Contract Number:
- AC36-08GO28308
- OSTI ID:
- 2293497
- Report Number(s):
- NREL/CP-5T00-88766; MainId:89545; UUID:1a06be3a-c786-42fc-96ce-e7d8bd0d0094; MainAdminId:71774
- Resource Relation:
- Conference: Presented at the 2023 IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SmartGridComm), 31 October - 3 November 2023, Glasgow, Scotland
- Country of Publication:
- United States
- Language:
- English
Similar Records
Assessment of the Electrical Substation-Grid Testbed with Inside/Outside Devices and Distributed Ledger Technology
Data-Centric Communication Framework for Multicast IEC 61850 Routable GOOSE Messages over the WAN in Modern Power Systems