Smart Grid Monitoring System(SGMS) is an important means to protect the security of smart grid. The high volumes of alerts generated by SGMS often confuse managers. Automatically handling alerts and extracting attack events is a critical issue for smart grid. Most of the existing security event analysis methods are designed for Internet, which will not be directly applicable to the power grid for high reliability and low attack tolerance requirements. In this paper, a multi-step attack detection model based on alerts of SGMS is proposed. In this model, an alert graph is constructed by IP correlation, and then transformed into candidate attack chains after being aggregated. Consequently, the candidate preliminary attack chains are pruned and denoised by negative causal correlation and non-cascading events. Finally, attack chains and visual attack graphs are formed. Our proposal model needs a little of priori knowledge while automatically extracting multi-step attack events and demonstrating the trajectories among IPs. The experimental results show the model performs well on China Grid data and DARPA 2000 data set. INDEX TERMS Smart grid security, alert correlation, multi-step attack, attack graph.

No abstract

No abstract

No abstract

Aiming at monitoring the behaviour of power system to make it work correctly and better, cyber physical power system (CPPS) was introduced. However, due to the high integration of cyber system, the complexity of power system is greatly enhanced, which puts forward higher requirements for the reliable and safe operation of CPPS. Moreover, when the cyber system is under attack, abnormal information flow may lead to abnormal energy flow. Therefore, this paper proposes a data transmission mechanism to analyse the information flow among CPPS. A data transmission optimization model based on the transmission matrix is constructed. The data transmission from the cyber system to the power system is quantified by the model. The practicability of the proposed data transmission mechanism is given by numerous cases.