On Holistic Multi-Step Cyberattack Detection via a Graph-based Correlation Approach

IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SmartGridComm), pp. 380–386

Abstract

While digitization of distribution grids through information and communications technology brings numerous benefits, it also increases the grid's vulnerability to serious cyber attacks. Unlike conventional systems, attacks on many industrial control systems such as power grids often occur in multiple stages, with the attacker taking several steps at once to achieve its goal. Detection mechanisms with situational awareness are needed to detect orchestrated attack steps as part of a coherent attack campaign. To provide a foundation for detection and prevention of such attacks, this paper addresses the detection of multi-stage cyber attacks with the aid of a graph-based cyber intelligence database and alert correlation approach. Specifically, we propose an approach to detect multi-stage attacks by lever-aging heterogeneous data to form a knowledge base and employ a model-based correlation approach on the generated alerts to identify multi-stage cyber attack sequences taking place in the network. We investigate the detection quality of the proposed approach by using a case study of a multi-stage cyber attack campaign in a future-orientated power grid pilot.

Authors 4

1. Ömer Sen Aachen

   RWTH Aachen University

   Affiliation as printed

   IAEW, RWTH Aachen Univserity,Aachen,Germany

   IAEW, RWTH Aachen Univserity, Aachen, Germany

2. Chijioke Eze Aachen

   RWTH Aachen University

   Affiliation as printed

   ACS, RWTH Aachen University,Aachen,Germany

   ACS, RWTH Aachen University, Aachen, Germany

3. Andreas Ulbig Aachen

   RWTH Aachen University

   Affiliation as printed

   IAEW, RWTH Aachen Univserity,Aachen,Germany

   IAEW, RWTH Aachen Univserity, Aachen, Germany

4. Antonello Monti Aachen

   RWTH Aachen University

   Affiliation as printed

   ACS, RWTH Aachen University,Aachen,Germany

   ACS, RWTH Aachen University, Aachen, Germany