A Novel Trust Model In Detecting Final-Phase Attacks in Substations

Boakye-Boateng, Kwasi; Ghorbani, Ali A.; Lashkari, Arash Habibi

doi:10.1109/pst52912.2021.9647848

Cited by 3 publications

(7 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In our preceding research, we underscored that computing trust involves two core constituents: familiarity (F i ) and consequence (C i ) [13,14]. Familiarity encapsulates three fundamental factors: frequency (E f ), intensity (E i ), and similarity (E s ).…”

Section: Trust Formulation For Substation Devicesmentioning

confidence: 97%

“…The trust (T ij ) that an agent (a i ) places in a subject (a j ) within a given time period (t) can be mathematically formulated as a tuple, as shown in Equation (1) [13]. In this equation, r ij represents the perceived risk associated with agent a i trusting subject a j , α ij denotes the nature of the transaction or communication between the two entities, k t ij signifies the knowledge acquired during the interaction between a i and a j within t, and T ′ ij denotes the previous trust value established between the two entities.…”

Section: Trustmentioning

confidence: 99%

“…The research conducted by Boakye-Boateng et al on trust incorporated the notion of communication familiarity between devices and the subsequent consequences of accepting a device's request to compute trust [13]. However, it is worth noting that their work, similar to the previously mentioned literature, did not include utilizing trust to determine the risk posture of the substation.…”

Section: State Of the Artmentioning

confidence: 99%

“…Modbus TCP/IP, a variant operating over TCP/IP on TCP port 502 [26], is a pragmatic choice due to its user-friendly interface, popularity, and comprehensive documentation. It was also the protocol employed in previous literature [13,14,18], facilitating its selection for further advancements. Furthermore, APTs such as PipeDream [3] have components that target the protocol.…”

Section: Modbus Tcpmentioning

confidence: 99%

See 3 more Smart Citations

Implementation of a Trust-Based Framework for Substation Defense in the Smart Grid

Boakye-Boateng,

Ghorbani,

Lashkari

2023

Smart Cities

Self Cite

View full text Add to dashboard Cite

The Smart Grid is a cyber-integrated power grid that manages electricity generation, transmission, and distribution to consumers and central to its functioning is the substation. However, integrating cyber-infrastructure into the substation has increased its attack surface. Notably, sophisticated attacks such as the PipeDream APT exploit multiple device protocols, such as Modbus, DNP3, and IEC61850. The substation’s constraints pose challenges for implementing security measures such as encryption and intrusion detection systems. To address this, we propose a comprehensive trust-based framework aimed at enhancing substation security. The framework comprises a trust model, a risk posture model, and a trust transferability model. The trust model detects protocol-based attacks on Intelligent Electronic Devices and SCADA HMI systems, while the risk posture model dynamically assesses the substation’s risk posture. The trust transferability model evaluates the feasibility of transferring and integrating a device and its trust capabilities into a different substation. The practical substation emulation involves a Docker-based testbed, employing a multi-agent architecture with a real-time Security Operations Center-influenced dashboard. Assessment involves testing against attacks guided by the MITRE ICS ATT&CK framework. Our framework displays resilience against diverse attacks, identifies malicious behavior, and rewards trustworthy devices.

show abstract

Section: Trust Formulation For Substation Devicesmentioning

confidence: 97%

Section: Trustmentioning

confidence: 99%

Section: State Of the Artmentioning

confidence: 99%

Section: Modbus Tcpmentioning

confidence: 99%

See 2 more Smart Citations

Implementation of a Trust-Based Framework for Substation Defense in the Smart Grid

Boakye-Boateng,

Ghorbani,

Lashkari

2023

Smart Cities

Self Cite

View full text Add to dashboard Cite

show abstract

“…But in the event that this protocol is used for the EVCS, physical access can be granted to the individuals responsible for these charging stations and fewer safety protocols are adopted. In this type of situations the attacker may have the possibility to access the network easily through social engineering methods [25], [26].…”

Section: Third Scenariomentioning

confidence: 99%

Impact and Vulnerability Analysis of IEC61850 in Smartgrids Using Multiple HIL Real-Time Testbeds

et al. 2022

View full text Add to dashboard Cite

Due to the increasing use of smart components in smart grids, interoperability among them is a crucial aspect to address. IEC61850 is a communication standard that has been already used in substations because of its instant data transfer and the ability to enable data exchange between a variety of smart energyrelated digital technologies. This article studies the application of the communication protocols defined by the IEC61850 standard in Intelligent Electronic Devices (IEDs) by using a prototype testbed architecture running on a real-time digital device. The goal of this activity is to study the impact of smart simulations and the vulnerability in terms of cyber-security. This testbed includes the supervisor, the substation bus, and the process bus communication layer creating a local network exchanging data at distinct levels. Different fault protection scenarios are discussed using both physical and emulated IEDs, and the communication protocols implemented in each scenario are explained showing that additional delays are introduced. In the first two scenarios, the operation of the testbed using physical versus emulated IEDs is analyzed and compared, ensuring the robustness of this methodology in situations where the use of a physical IED would be unfeasible. In these scenarios, the functionality and robustness of the protection mechanisms and communication protocols are confirmed. In the third scenario vulnerability of smart grids that use IEC61850 as their primary communication protocol to data injection attacks is studied. Sniffing the local network, packets are captured and monitored. Spoofed data with the same structure are injected into the network to conduct false data injection attacks on the supervisory unit. Vulnerability to cyber attacks of the IEC61850 protocol in specific situations is shown.

show abstract

Securing Substations with Trust, Risk Posture, and Multi-Agent Systems: A Comprehensive Approach

Boakye-Boateng,

Ghorbani,

Lashkari

2023

2023 20th Annual International Conference on Privacy, Security and Trust (PST)

View full text Add to dashboard Cite

A Novel Trust Model In Detecting Final-Phase Attacks in Substations

Cited by 3 publications

References 20 publications

Implementation of a Trust-Based Framework for Substation Defense in the Smart Grid

Implementation of a Trust-Based Framework for Substation Defense in the Smart Grid

Impact and Vulnerability Analysis of IEC61850 in Smartgrids Using Multiple HIL Real-Time Testbeds

Securing Substations with Trust, Risk Posture, and Multi-Agent Systems: A Comprehensive Approach

Contact Info

Product

Resources

About