Semantic security analysis of SCADA networks to detect malicious control commands in power grids

Authors:
Hui Lin;Adam Slagell;Zbigniew Kalbarczyk;Peter W. Sauer;Ravishankar K. Iyer
Affiliations:
Coordinated Science Laboratory, Champaign, IL, USA;National Center for Supercomputing Applications, Champaign, IL, USA;Coordinated Science Laboratory, Champaign, IL, USA;Department of Electrical and Computer Engineering, Champaign, IL, USA;Coordinated Science Laboratory, Champaign, IL, USA
Venue:
Proceedings of the first ACM workshop on Smart energy grid security
Year:
2013

Citing 4
Cited 0

Power System Extreme Event Detection: The Vulnerability Frontier

HICSS '08 Proceedings of the Proceedings of the 41st Annual Hawaii International Conference on System Sciences
False data injection attacks against state estimation in electric power grids

Proceedings of the 16th ACM conference on Computer and communications security
State-based network intrusion detection systems for SCADA protocols: a proof of concept

CRITIS'09 Proceedings of the 4th international conference on Critical information infrastructures security
Adapting Bro into SCADA: building a specification-based intrusion detection system for the DNP3 protocol

Proceedings of the Eighth Annual Cyber Security and Information Intelligence Research Workshop

Quantified Score

Hi-index	0.00

Visualization

Abstract

In the current generation of SCADA (Supervisory Control And Data Acquisition) systems used in power grids, a sophisticated attacker can exploit system vulnerabilities and use a legitimate maliciously crafted command to cause a wide range of system changes that traditional contingency analysis does not consider and remedial action schemes cannot handle. To detect such malicious commands, we propose a semantic analysis framework based on a distributed network of intrusion detection systems (IDSes). The framework combines system knowledge of both cyber and physical infrastructure in power grid to help IDS to estimate execution consequences of control commands, thus to reveal attacker's malicious intentions. We evaluated the approach on the IEEE 30-bus system. Our experiments demonstrate that: (i) by opening 3 transmission lines, an attacker can avoid detection by the traditional contingency analysis and instantly put the tested 30-bus system into an insecure state and (ii) the semantic analysis provides reliable detection of malicious commands with a small amount of analysis time.