1,721,073 research outputs found
Hardware-in-the-Loop CPS Security Architecture for DER Monitoring and Control Applications
Get PDFDeeper penetration of interoperable cyber-physical distributed energy resources (DER) and their utility-wide remote monitoring and control drastically increases cybersecurity attack surface. Utilities require to adopt the DER interconnection and communication standards to a range of autonomous, advanced and curve-based grid-support functions to securely monitor and control DER devices for ensuring power quality, voltage, and system frequency. In this paper, we present DER monitoring and control (DERMC) cyber-physical system (CPS) architecture including standard communication protocols such as IEEE 2030.5 [1] and discuss various stealthy cyber attack vectors that affect communications and operations of DER. We propose a hardware-in-the-loop (HIL) CPS security architecture and testbed design with industry-grade software and hardware systems and a real-time digital simulator for high-fidelity grid impact characteristic analysis against cyber attack vectors. We use the testbed to demonstrate impact characteristics for modified IEEE 13 bus system including 11 solar photovoltaic units. The experiments demonstrated significant results by 100% real-time performance and zero overruns.This is a manuscript of a proceeding published as Ravikumar, Gelli, Burhan Hyder, and Manimaran Govindarasu. "Hardware-in-the-Loop CPS Security Architecture for DER Monitoring and Control Applications." In 2020 IEEE Texas Power and Energy Conference (TPEC). (2020). DOI: 10.1109/TPEC48276.2020.9042578. Posted with permission.</p
Cyber Kill Chain-Based Hybrid Intrusion Detection System for Smart Grid
Get PDFToday’s electric power grid is a complex, automated, and interconnected cyber-physical system (CPS) that relies on supervisory control and data acquisition (SCADA)-based communication infrastructure for operating wide-area monitoring, protection, and control (WAMPAC) applications. With a push towards making the grid smarter, the critical SCADA infrastructure like power system is getting exposed to countless cyberattacks that necessitate the development of state-of-the-art intrusion detection systems (IDS) to provide comprehensive security solutions at different layers in the smart grid network. While considering the continuously evolving attack surfaces at physical, communication, and application layers, existing conventional IDS solutions are insufficient and incapable to resolve multi-dimensional cybersecurity threats because of their specific nature of the operation, either a data-centric or protocol-centric, to detect specific types of attacks. This chapter presents a hybrid intrusion detection system framework by integrating a network-based IDS, model-based IDS, and state-of-the-art machine learning-based IDS to detect unknown and stealthy cyberattacks targeting the SCADA networks. We have applied the cyber-kill model to develop and demonstrate attack vectors and their associated mechanisms. The hybrid IDS utilizes attack signatures in grid measurements and network packets as well as leverages secure phasor measurements to detect different stages of cyber-attacks while following the kill-chain process. As a proof of concept, we present the experimental case study in the context of centralized wide-area protection (CWAP) cybersecurity by utilizing resources of the PowerCyber testbed at Iowa State University (ISU). We also describe different classes of implemented cyber-attacks and generated heterogeneous datasets using the IEEE 39 bus system. Finally, the performance of the hybrid IDS is evaluated based in terms of detection rate in real-time cyber-physical environment.This is a post-peer-review, pre-copyedit version of a chapter published as Singh, Vivek Kumar, and Manimaran Govindarasu. "Cyber Kill Chain-Based Hybrid Intrusion Detection System for Smart Grid." In: Haes Alhelou H., Abdelaziz A.Y., and Siano P. (eds.) Wide Area Power Systems Stability, Protection, and Security. (2021): 571-599. The final authenticated version is available online at DOI:10.1007/978-3-030-54275-7_22. Posted with permission.</p
A composable approach to design of newer techniques for large-scale denial-of-service attack attribution
Get PDFSince its early days, the Internet has witnessed not only a phenomenal growth, but also a large number of security attacks, and in recent years, denial-of-service (DoS) attacks have emerged as one of the top threats. The stateless and destination-oriented Internet routing combined with the ability to harness a large number of compromised machines and the relative ease and low costs of launching such attacks has made this a hard problem to address. Additionally, the myriad requirements of scalability, incremental deployment, adequate user privacy protections, and appropriate economic incentives has further complicated the design of DDoS defense mechanisms. While the many research proposals to date have focussed differently on prevention, mitigation, or traceback of DDoS attacks, the lack of a comprehensive approach satisfying the different design criteria for successful attack attribution is indeed disturbing.
Our first contribution here has been the design of a composable data model that has helped us represent the various dimensions of the attack attribution problem, particularly the performance attributes of accuracy, effectiveness, speed and overhead, as orthogonal and mutually independent design considerations. We have then designed custom optimizations along each of these dimensions, and have further integrated them into a single composite model, to provide strong performance guarantees. Thus, the proposed model has given us a single framework that can not only address the individual shortcomings of the various known attack attribution techniques, but also provide a more wholesome counter-measure against DDoS attacks.
Our second contribution here has been a concrete implementation based on the proposed composable data model, having adopted a graph-theoretic approach to identify and subsequently stitch together individual edge fragments in the Internet graph to reveal the true routing path of any network data packet. The proposed approach has been analyzed through theoretical and experimental evaluation across multiple metrics, including scalability, incremental deployment, speed and efficiency of the distributed algorithm, and finally the total overhead associated with its deployment. We have thereby shown that it is realistically feasible to provide strong performance and scalability guarantees for Internet-wide attack attribution.
Our third contribution here has further advanced the state of the art by directly identifying individual path fragments in the Internet graph, having adopted a distributed divide-and-conquer approach employing simple recurrence relations as individual building blocks. A detailed analysis of the proposed approach on real-life Internet topologies with respect to network storage and traffic overhead, has provided a more realistic characterization. Thus, not only does the proposed approach lend well for simplified operations at scale but can also provide robust network-wide performance and security guarantees for Internet-wide attack attribution.
Our final contribution here has introduced the notion of anonymity in the overall attack attribution process to significantly broaden its scope. The highly invasive nature of wide-spread data gathering for network traceback continues to violate one of the key principles of Internet use today - the ability to stay anonymous and operate freely without retribution. In this regard, we have successfully reconciled these mutually divergent requirements to make it not only economically feasible and politically viable but also socially acceptable.
This work opens up several directions for future research - analysis of existing attack attribution techniques to identify further scope for improvements, incorporation of newer attributes into the design framework of the composable data model abstraction, and finally design of newer attack attribution techniques that comprehensively integrate the various attack prevention, mitigation and traceback techniques in an efficient manner.</p
Evaluation of Anomaly Detection for Wide-Area Protection Using Cyber Federation Testbed
Get PDFCyber physical security research for smart grid is currently one of the nation’s top R&D priorities. The existing vulnerabilities in the legacy grid infrastructure make it particularly susceptible to countless cyber-attacks. There is a growing emphasis towards building interconnected, sophisticated federated testbeds to perform realistic experiments by allowing the integration of geographically-dispersed resources in the dynamic cyber-physical environment. In this paper, we present a cyber (network) based federation testbed to validate the performance of an anomaly detector in context of a Wide Area Protection (WAP) security. Specifically, we have utilized the resources available at the Iowa State University Power Cyber (ISU PCL) Laboratory to emulate the substation and local center networks; and the US Army Research Laboratory (ARL); to emulate the regional control center network. Initially, we describe a hardware-in-the loop based experimental setup for implementing data integrity attacks on an IEEE 39 bus system. We then perform network packet analysis focusing on latency and bandwidth as well as evaluate the performance of a decision tree based anomaly detector in measuring its ability to identify different attacks. Our experimental results reveal the computed wide area network latency; bandwidth requirement for minimum packet loss; and successful performance of the anomaly detector. Our studies also highlight the conceptual architecture necessary for developing the federated testbed, inspired by the NASPI network.This proceeding is published as Singh, Vivek Kumar, Manimaran Govindarasu, Donald Porschet, Edward Shaffer, and Morris Berman. "Evaluation of Anomaly Detection for Wide-Area Protection Using Cyber Federation Testbed." (2019).</p
Practical SIEM tools for SCADA environment
Get PDFSupervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS) are increasingly under attack in recent years. Every year we developed more secure architectures. Security Information and Event Management (SIEM) systems are getting widely popular nowadays for different sectors of the industry but few for ICS/SCADA systems. We are lacking monitoring and alerting systems in the Power Grid. In today world business in different sectors of the industry use common defenses such as firewalls, two factor authentication, egress filtering and others to try to prevent attackers from getting into the network. While these defenses provide some security for known attacks other kinds of attacks are not detected. Anomaly behavior is difficult to detect and the previous defenses are not helping once an attacker is inside the network.
Typical SCADA systems lack monitoring systems in the OT network as is not part of the IT network. This paper provides an easy way to step up a monitoring and alerting system for substation in the OT network. Security onion is a free open source software that is deployed as a NIDS (Network Intrusion Detection System) on the OT network. The experiment was conducted using the Power Grid Lab in Iowa State using Siemens Relays.
In this paper, we provide a solution that incorporates a SIEM solution using well known free open source tools on the Security Onion Linux Distribution for monitoring and logging. We first understand why a SIEM solution is a good choice to be implemented in a ICS. Its advantages and capabilities and other cases where a SIEM solution have proved to help security. Later we also provide with a three-layer detection system for intrusion for Substations based on anomaly and signature detection using Snort as well as implementation, evaluation and results.</p
Moving target defense for securing smart grid communications: Architectural design, implementation and evaluation
Get PDFSupervisory Control And Data Acquisition (SCADA) communications are often subjected to various kinds of sophisticated cyber-attacks which can have a serious impact on the Critical Infrastructure such as the power grid. Most of the time, the success of the attack is based on the static characteristics of the system, thereby enabling an easier profiling of the target system(s) by the adversary and consequently exploiting their limited resources. In this thesis, a novel approach to mitigate such static vulnerabilities is proposed by implementing a Moving Target Defense (MTD) strategy in a power grid SCADA environment, which leverages the existing communication network with an end-to-end IP Hopping technique among the trusted peer devices. This offers a proactive L3 layer network defense, minimizing IP-specific threats and thwarting worm propagation, APTs, etc., which utilize the cyber kill chain for attacking the system through the SCADA network. The main contribution of this thesis is to show how MTD concepts provide proactive defense against targeted cyber-attacks, and a dynamic attack surface to adversaries without compromising the availability of a SCADA system.
Specifically, the thesis presents a brief overview of the different type of MTD designs, the proposed MTD architecture and its implementation with IP hopping technique over a Control Center–Substation network link along with a 3-way handshake protocol for synchronization on the Iowa State’s Power Cyber testbed. The thesis further investigates the delay and throughput characteristics of the entire system with and without the MTD to choose the best hopping rate for the given link. It also includes additional contributions for making the testbed scenarios more realistic to real world scenarios with multi-hop, multi-path WAN. Using that and studying a specific attack model, the thesis analyses the best ranges of IP address for different hopping rate and different number of interfaces. Finally, the thesis describes two case studies to explore and identify potential weaknesses of the proposed mechanism, and also experimentally validate the proposed mitigation alterations to resolve the discovered vulnerabilities. As part of future work, we plan to extend this work by optimizing the MTD algorithm to be more resilient by incorporating other techniques like network port mutation to further increase the attack complexity and cost.</p
Scalable and Modular Implementation of Scenario-based Cyber Attacks and Defense Methodologies on CPS Security SCADA Testbed
Get PDFThe electric power grids in the United States are slowly being converted into Smart Grids, which deploy digital technology that facilitates two-way communication between utilities and the customers, detect and react to local changes in usage. This conversion opens up many vulnerabilities and security pitfalls that never existed before.A recent example of an attack that had major impacts on the Power Grid is the cyber attack on the Ukrainian power grid. To combat these kinds of cyber attacks on critical infrastructures, we present a realistic moderate-cost modular test bed and evaluate using two case studies: Black Energy attack (2015) and Crash Override attack (2016) that happened in the Ukraine power grid. A design methodology for a modular test bed capable of performing a complex security assessment for cyber-physical systems is formulated, evaluated using the aforementioned attacks, some possible defense measures and some unique insights on these types of attacks are delineated. The experiments were carried out in PowerCyber test bed of Iowa State University</p
Power management algorithms for IoT platforms
Get PDFThe Internet of Things (IoT) is a platform that connects various electronic systems such as home appliances, vehicles, and medical devices through wired or wireless communications. Without recharging the battery of sensors and mobile systems in IoT networks, their usage time is limited. In order to improve performance with finite battery energy, power management is used to conserve the energy dissipation of sensor networks and mobile systems. This dissertation addresses power management in two categories of systems within IoT: wireless sensor networks (WSNs) and electric vehicles (EVs).
For power management in WSNs, this dissertation develops an algorithm using network coding (NC). When one sender transmits multiple packets to different receivers in a WSN, an NC algorithm reduces transmissions between the sender and the receivers by encoding many packets into one packet. Consequently, the total communication energy between the sender and the receivers is decreased. For further study about real energy gains generated by NC algorithms, we develop a wireless testbed by using mobile devices. Consequently, by varying different network variables such as transmission range of a sender and the number of receivers in the testbed network, we discover network conditions where communication energy saved by NC algorithms is increased. However, NC algorithms spend operational energy overheads for algorithm execution, encoding, and decoding. Hence, our research also shows the threshold conditions where the energy saved by the NC algorithms are larger than the energy overheads with consideration of communication variables or algorithm complexity in order to identify opportunities for energy savings.
For power management of EVs, this dissertation develops an energy-efficient algorithm using neural networks which can be used for power management of EVs' electronic control system. Power management saves energy consumption of the electronic control system by selectively activating electronic control units (ECUs) in the system. However, the energy savings generated by the power management could be less than the energy overheads used for the selective ECU activation and deactivation. Our algorithm experiences events where energy overheads were greater than energy savings and trains neural networks for the experienced events. The neural networks forecast energy-inefficient events and conserve energy overheads based on the predicted events. Our simulation study using real driving datasets shows that the algorithm improves the energy dissipation of the electronic control system by 5% to 7%.</p
Cloud infrastructure for multi-sensor remote data acquisition system for precision agriculture (CSR-DAQ)
Get PDFWhile there are a lot of precision agriculture data acquisition systems in the market today, not many are equipped with the power of cloud computing. There are a lot of shortcomings of the on-premises solutions, some of which are 1) unavailability of live data globally; 2) unreliable and insecure data management system; 3) lack of scalability due to limited storage availability. Merging cloud computing with the existing Internet of Things(IoT) solutions will not just resolve the above issues but also allow clients to use cloud-hosted applications that will enable them to manage and monitor their system from anywhere in the world.
In this project, we are proposing a cloud infrastructure for data acquisition systems to move the database from on-prem to the cloud and add a plethora of advantages that cloud computing offers. The proposed architecture is based on Message Queue Telemetry Transport (MQTT) protocol and is hosted on Amazon. The key components of this architecture include an MQTT Client, MQTT Broker, MQTT Rules Engine, Cloud-based Database, Server to host client applications, and Client applications (Website and Android). The MQTT Client is the data aggregator sensor node that collects all the information from the field. The MQTT Broker is the bridge between the IoT clients and the cloud and is responsible for routing messages to and from the clients. The MQTT Rules Engine routes these messages to the appropriate destination and takes subsequent actions accordingly. As data is key in any IoT application, all the data is maintained in a centralized Dynamo DB hosted on the cloud. This data is then utilized by the client applications for 1) providing the user with visualization of the information being gathered by the data acquisition system; 2) managing the entities of the system; 3) monitoring the system by setting alerts. For hosting the above applications, we have utilized Amazon’s Elastic Compute Cloud Amazon EC2).
For testing the cloud-infrastructure and the client applications, a virtual Linux machine was set up that emulated the behavior of a CSR-DAQ data aggregator node. This data aggregator node pushed sensor data on the AWS cloud, where it was stored in a DynamoDB table. The consequent test values pushed from the node were reflected in the table in the order they were sent. This confirmed that the cloud infrastructure worked seamlessly and allowed the user to obtain the current status of the soil. The alert mechanism was also validated, and it generated Email and SMS notifications when the soil moisture was not within the user-defined soil moisture limits. Thus, this cloud infrastructure provides a cost-effective solution for data acquisition systems and allows the farmer to access and manage the data from their fields at any point.</p
Cyber risk modeling and attack-resilient control for power grid
Get PDFThe electric power grid is a cyber-physical system (CPS) that forms the lifeline of modern society. Sophisticated control applications that constantly monitor critical power system variables, such as voltage and frequency, enable system operators to deliver reliable and high-quality power. The advanced devices and communication infrastructure of the Supervisory Control and Data Acquisition (SCADA) system enable control applications ranging from substation-level voltage control schemes to system-wide automatic generation control (AGC). However, inherent cyber security vulnerabilities in the infrastructure put system operation at risk by providing an attack surface to cyber threat actors. A smart attacker, that is, a cyber threat actor with expertise in physical power system operation could cause severe damage to the power grid infrastructure and its reliability by stealthily manipulating SCADA operation. This dissertation explores such impacts to power grid operation from cyber attacks and more importantly, introduces novel mitigation schemes to minimize or negate the impacts. It has two primary components - risk modeling of coordinated cyber attacks and attack resilient control.
The first component of this thesis focuses on coordinated cyber attacks, that is, attacks target multiple power system components simultaneously. The notion of spatial and temporal coordinated cyber attacks and their impact on power system transmission infrastructure is introduced. The impact from these attacks was captured in terms of traditional power system stability metrics. The results reveal that these extreme events demand a rethink of both power system planning and operations methods by way of including cyber-originated contingencies within the scope. To this end, a systematic risk modeling framework is proposed as mitigation to be used in power systems planning. The risk for a substation is modeled as the product of the vulnerability of its SCADA infrastructure and the impact from its compromise. The vulnerability is obtained by modeling the SCADA network using Stochastic Petri Nets. Impact to system reliability is quantified in terms of transmission line overloads and the resulting forced load shedding. The methodology is applied to a test power system and the attack vectors are ranked according to risk. This methodology could therefore employed by system planners to evaluate infrastructural upgrade requirements and identify security enhancements. An enhancement to the contingency analysis application is proposed as mitigation during online operation. The proposed algorithm efficiently captures impactful coordinated vectors by significantly reducing the number of cases to be evaluated. Results reveal the algorithm's ability to identify almost all impactful attack vectors for a line under review without the need for a complete study.
The second component of the thesis explores the impact of data integrity attacks on power system control applications. Specifically, the impact of data integrity attacks on Automatic Generation Control (AGC) is examined and Attack-Resilient Control (ARC) is proposed as mitigation. ARC for AGC proposes the use of physical system information to design algorithms for detect and mitigation of cyber attacks. Specifically, model-based anomaly detection and attack mitigation algorithm was developed for AGC using short-term load forecast data. The performance of AGC was tested on a standard test system with and without ARC. The results show that ARC for AGC is able to detect data integrity attacks, maintain system within stability margins and enhance overall system security by providing defense-in-depth.
Future work includes expanding the risk analysis framework to include different types of coordinated attacks and to compare impact expressed in different power system metrics. Mitigation of temporal coordinated attacks and transient stability analysis of spatial and temporal attacks are also a part of future work. Finally, the attack resilient control framework should be enhanced to differentiate abnormal measurements due to cyber attacks from legitimate aberrations due to power system contingencies.</p
- …
