A Case Study in Power Substation Network Dynamics

Abstract

The modern world is becoming increasingly dependent on computing and communication technology to function, but unfortunately its application and impact on areas such as critical infrastructure and industrial control system (ICS) networks remains to be thoroughly studied. Significant research has been conducted to address the myriad security concerns in these areas, but they are virtually all based on artificial testbeds or simulations designed on assumptions about their behavior either from knowledge of traditional IT networking or from basic principles of ICS operation. In this work, we provide the most detailed characterization of an example ICS to date in order to determine if these common assumptions hold true. A live power distribution substation is observed over the course of two and a half years to measure its behavior and evolution over time. Then, a horizontal study is conducted that compared this behavior with three other substations from the same company. Although most predictions were found to be correct, some unexpected behavior was observed that highlights the fundamental differences between ICS and IT networks including round trip times dominated by processing speed as opposed to network delay, several well known TCP features being largely irrelevant, and surprisingly large jitter from devices running real-time operating systems. The impact of these observations is discussed in terms of generality to other embedded networks, network security applications, and the suitability of the TCP protocol for this environment.

Anomaly Detection for SCADA System Security Based on Unsupervised Learning and Function Codes Analysis in the DNP3 Protocol

“…The datasets shown in the paper were taken from four medium-voltage distribution substations non-consecutively over the course of two-and-a-half years. Formby, et al [20], also investigated TCP characteristics based on the real traffic captured from real power grid networks. Their observations mainly focused on the TCP behaviors of the DNP3 devices that could be distinguished from those in the traditional network.…”

“…In this study, we focused on possible attacks by interlopers able to manipulate the function codes of the message. We generated DNP3 application traffic, and formulated various datasets that reflected the traffic characteristics of DNP3 application messages, which were observed in real-life substations for a long time period [19][20][21]. Based on the datasets generated in this way, we used the occurrences of each function code per TCP connection as input features.…”

If I Knew Then What I Know Now

“…In addition to this, research was published in 2014 that provided a high-level look at power substation traffic [21]. Then in 2017, an in-depth study was published that provided a more detailed characterization [15] of behavior across multiple substations and discussed methods to improve TCP for ICS networks.…”

Understanding IEC-60870-5-104 Traffic Patterns in SCADA Networks

“…Kleinman and Wool also applied the DFA approach to S7 protocol [12]. In 2017, Formby et al [9] characterized the power grid traffic. This work focused on DNP3 protocol and examined some common assumptions about the SCADA network such as stable traffic volume, regularity of DNP3 poll time, and long availability of SCADA devices.…”