A Framework for Evaluating Intrusion Detection Architectures in Advanced Metering Infrastructures

Cárdenas, Álvaro A.; Berthier, Robin; Bobba, Rakesh B.; Huh, Jun Ho; Jetcheva, Jorjeta G.; Grochocki, David; Sanders, William H.

doi:10.1109/tsg.2013.2291004

Cited by 46 publications

(16 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The framework proposed by Cardenas et al [5] is the closest to the methodology proposed in this paper. Cardenas and colleagues have developed a cost-model-based framework that assists electric utilities in provisioning intrusion detection systems.…”

Section: Related Workmentioning

confidence: 94%

“…Equation (4) ensures that the bandwidth required to route flows on link (j, l) does not exceed the link capacity and constraints. Equation (5) ensures that the capacity of the detection device v is not exceeded. Equation (6) ensures that the routing path of flow i has at least one detection device of type v. In the case of insufficient resources, this constraint also enforces o i = 1 and, as a result, it activates the penalty costs c P i in the objective function.…”

Section: Distributed Intrusion Detection Design Problemmentioning

confidence: 99%

See 1 more Smart Citation

A framework for designing resilient distributed intrusion detection systems for critical infrastructures

Genge

Haller

Kiss

2016

International Journal of Critical Infrastructure Protection

View full text Add to dashboard Cite

Section: Related Workmentioning

confidence: 94%

Section: Distributed Intrusion Detection Design Problemmentioning

confidence: 99%

A framework for designing resilient distributed intrusion detection systems for critical infrastructures

Genge

Haller

Kiss

2016

International Journal of Critical Infrastructure Protection

View full text Add to dashboard Cite

“…Hence, it was infeasible to directly study implications of topological aspects over the proposed detection mechanism. Given an AMI system (see Fig 5), any proposed intrusion detection module can be implemented in a decentralized or centralized manner in an AMI network as reported in [3], and micro-grid size affects the sensitivity of the attack detection. In a decentralized implementation, a detection module is usually deployed in either FAN (field area network if present) or NAN (neighborhood area network) gateway, that guards different smaller micro-grid subnets within the whole AMI network separately, while a centralized module is deployed in the Utility WAN gateway having a global view of a larger size of meters.…”

Section: Deployment Issues Of Proposed Detectormentioning

confidence: 99%

Detection and Forensics against Stealthy Data Falsification in Smart Metering Infrastructure

Bhattacharjee

Das

2021

IEEE Trans. Dependable and Secure Comput.

View full text Add to dashboard Cite

False power consumption data injected from compromised smart meters in Advanced Metering Infrastructure (AMI) of smart grids is a threat that negatively affects both customers and utilities. In particular, organized and stealthy adversaries can launch various types of data falsification attacks from multiple meters using smart or persistent strategies. In this paper, we propose a real time, two tier attack detection scheme to detect orchestrated data falsification under a sophisticated threat model in decentralized micro-grids. The first detection tier monitors whether the Harmonic to Arithmetic Mean Ratio of aggregated daily power consumption data is outside a normal range known as safe margin. To confirm whether discrepancies in the first detection tier is indeed an attack, the second detection tier monitors the sum of the residuals (difference) between the proposed ratio metric and the safe margin over a frame of multiple days. If the sum of residuals is beyond a standard limit range, the presence of a data falsification attack is confirmed. Both the 'safe margins' and the 'standard limits' are designed through a 'system identification phase', where the signature of proposed metrics under normal conditions are studied using real AMI micro-grid data sets from two different countries over multiple years. Subsequently, we show how the proposed metrics trigger unique signatures under various attacks which aids in attack reconstruction and also limit the impact of persistent attacks. Unlike metrics such as CUSUM or EWMA, the stability of the proposed metrics under normal conditions allows successful real time detection of various stealthy attacks with ultra-low false alarms.

show abstract

“…Effectively, SCADA is an example of an early M2M protocol [42][43][44][45][46][47][48][49][50]. SCADA is a well-known control system architecture for industrial process management.…”

Section: Scada Is An Example Of M2mmentioning

confidence: 99%

IoT Applications to Smart Campuses and a Case Study

Minoli¹

2017

EAI Endorsed Transactions on Smart Cities

View full text Add to dashboard Cite

Internet of Things (IoT) concepts are now being broadly investigated for actual deployment initiatives. Although ecosystem-wide architectures and standards are still slowly evolving and/or still lacking, some progress is being made; standardization fosters flexibility, cost-effectiveness, and ubiquitous deployment. Applications range from infrastructure and critical-infrastructure support (for example smart grid, smart city, smart building, and transportation), to end-user applications such as e-health, crowdsensing, and further along, to a multitude of other applications where only the imagination is the limit. This article discusses a specific example of an IoT application supporting Smart Campuses. Smart Campuses are part of a continuum that spans cities at the large-scale end to smart buildings at the small-scale end, and encompass universities, business parks, hospitals, housing developments, correctional facilities, and other real estate environments. The specific Use Case example covered in this article relates to an actual project to automate some key functions at a set of large campuses, but the nature of the campus is not directly revealed. After a review of the applicable IoT and control technologies, this Best Practices article describes technological solutions that were employed to support the requisite control functions and serves as an example for the applicability of IoT to Smart Campus applications.

show abstract

A Framework for Evaluating Intrusion Detection Architectures in Advanced Metering Infrastructures

Cited by 46 publications

References 12 publications

A framework for designing resilient distributed intrusion detection systems for critical infrastructures

A framework for designing resilient distributed intrusion detection systems for critical infrastructures

Detection and Forensics against Stealthy Data Falsification in Smart Metering Infrastructure

IoT Applications to Smart Campuses and a Case Study

Contact Info

Product

Resources

About