On specification-based cyber-attack detection in smart grids

Energy Informatics, vol. 5

Abstract

Abstract The transformation of power grids into intelligent cyber-physical systems brings numerous benefits, but also significantly increases the surface for cyber-attacks, demanding appropriate countermeasures. However, the development, validation, and testing of data-driven countermeasures against cyber-attacks, such as machine learning-based detection approaches, lack important data from real-world cyber incidents. Unlike attack data from real-world cyber incidents, infrastructure knowledge and standards are accessible through expert and domain knowledge. Our proposed approach uses domain knowledge to define the behavior of a smart grid under non-attack conditions and detect attack patterns and anomalies. Using a graph-based specification formalism, we combine cross-domain knowledge that enables the generation of whitelisting rules not only for statically defined protocol fields but also for communication flows and technical operation boundaries. Finally, we evaluate our specification-based intrusion detection system against various attack scenarios and assess detection quality and performance. In particular, we investigate a data manipulation attack in a future-orientated use case of an IEC 60870-based SCADA system that controls distributed energy resources in the distribution grid. Our approach can detect severe data manipulation attacks with high accuracy in a timely and reliable manner.

Authors 7

1. Ömer Sen corresponding Aachen High Voltage Equipment and Grids

   Fraunhofer Institute for Applied Information Technology · RWTH Aachen University

   Affiliation as printed

   Fraunhofer Institute for Applied Information Technology FIT, Sankt Augustin, Germany

   High Voltage Equipment and Grids, Digitalization and Energy Economics, RWTH Aachen University, Aachen, Germany

   High Voltage Equipment and Grids, Digitalization and Energy Economics, RWTH Aachen University, Schinkelstraße 6, 52062, Aachen, Germany

2. Dennis van der Velde Aachen High Voltage Equipment and Grids

   Fraunhofer Institute for Applied Information Technology · RWTH Aachen University

   Affiliation as printed

   Fraunhofer Institute for Applied Information Technology FIT, Sankt Augustin, Germany

   High Voltage Equipment and Grids, Digitalization and Energy Economics, RWTH Aachen University, Aachen, Germany

   High Voltage Equipment and Grids, Digitalization and Energy Economics, RWTH Aachen University, Schinkelstraße 6, 52062, Aachen, Germany

3. Maik Lühman Aachen High Voltage Equipment and Grids

   RWTH Aachen University

   Affiliation as printed

   High Voltage Equipment and Grids, Digitalization and Energy Economics, RWTH Aachen University, Aachen, Germany

   High Voltage Equipment and Grids, Digitalization and Energy Economics, RWTH Aachen University, Schinkelstraße 6, 52062, Aachen, Germany

4. Florian Sprünken Aachen High Voltage Equipment and Grids

   RWTH Aachen University

   Affiliation as printed

   High Voltage Equipment and Grids, Digitalization and Energy Economics, RWTH Aachen University, Aachen, Germany

   High Voltage Equipment and Grids, Digitalization and Energy Economics, RWTH Aachen University, Schinkelstraße 6, 52062, Aachen, Germany

5. Immanuel Hacker Aachen High Voltage Equipment and Grids

   Fraunhofer Institute for Applied Information Technology · RWTH Aachen University

   Affiliation as printed

   Fraunhofer Institute for Applied Information Technology FIT, Sankt Augustin, Germany

   High Voltage Equipment and Grids, Digitalization and Energy Economics, RWTH Aachen University, Aachen, Germany

   High Voltage Equipment and Grids, Digitalization and Energy Economics, RWTH Aachen University, Schinkelstraße 6, 52062, Aachen, Germany

6. Andreas Ulbig Aachen High Voltage Equipment and Grids

   Fraunhofer Institute for Applied Information Technology · RWTH Aachen University

   Affiliation as printed

   Fraunhofer Institute for Applied Information Technology FIT, Sankt Augustin, Germany

   High Voltage Equipment and Grids, Digitalization and Energy Economics, RWTH Aachen University, Aachen, Germany

   Fraunhofer Institute for Applied Information Technology FIT, Schloss Birlinghoven, Konrad-Adenauer-Straße, 53757, Sankt Augustin, Germany

7. Martin Henze Aachen Security and Privacy in Industrial Cooperation

   Fraunhofer Institute for Communication, Information Processing and Ergonomics · RWTH Aachen University

   Affiliation as printed

   Fraunhofer Institute for Communication, Information Processing and Ergonomics FKIE, Wachtberg, Germany

   Security and Privacy in Industrial Cooperation, RWTH Aachen University, Aachen, Germany

   Security and Privacy in Industrial Cooperation, RWTH Aachen University, Ahornstraße 55, 52074, Aachen, Germany