A survey of electric power synchrophasor network cyber security

Beasley, Christopher; Zhong, Xingsi; Deng, Juan; Brooks, Richard; Venayagamoorthy, G.K.

doi:10.1109/isgteurope.2014.7028738

Cited by 49 publications

(21 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Chen et al [25] used traffic timing information to detect the centralized Zeus botnet. The reasons to use timing information are: (1) The use of security gateways and VPN tunnels to encrypt PMU traffic eliminates many possible vulnerabilities [3,45], but these devices are still vulnerable to Denial of Service (DoS) attacks that exploit a side-channel vulnerability. In [44], encrypted PMU measurement traffic is identified and dropped through an exploitation of side-channel vulnerabilities.…”

Section: Identify Botnet Trafficmentioning

confidence: 99%

Using Markov Models and Statistics to Learn, Extract, Fuse, and Detect Patterns in Raw Data

Brooks

et al. 2018

Proceedings of International Symposium on Sensor Networks, Systems and Security

Self Cite

View full text Add to dashboard Cite

Many systems are partially stochastic in nature. We have derived datadriven approaches for extracting stochastic state machines (Markov models) directly from observed data. This chapter provides an overview of our approach with numerous practical applications. We have used this approach for inferring shipping patterns, exploiting computer system side-channel information, and detecting botnet activities. For contrast, we include a related data-driven statistical inferencing approach that detects and localizes radiation sources. IntroductionMarkov models have been widely used for detecting patterns [33,36,7,4,24,25,15,17]. The premise behind a Markov models is that the current state only depends on the previous state and that transition probabilities are stationary. This makes Markov models versatile, as this is a direct result of the causal world we live in. Often,

show abstract

Section: Identify Botnet Trafficmentioning

confidence: 99%

Using Markov Models and Statistics to Learn, Extract, Fuse, and Detect Patterns in Raw Data

Brooks

et al. 2018

Proceedings of International Symposium on Sensor Networks, Systems and Security

Self Cite

View full text Add to dashboard Cite

show abstract

“…In short, cyber attacks on a synchrophasor based system could lead to extreme consequences. Several survey articles (Yan et al (2012), Boyer et al (2009), Beasley et al (2014) have addressed security challenges for synchrophasors and smart grid in general.…”

Section: Synchrophasor Technologymentioning

confidence: 99%

Threat Analysis of BlackEnergy Malware for Synchrophasor based Real-time Control and Monitoring in Smart Grid

Khan

Maynard

McLaughlin

et al. 2016

Electronic Workshops in Computing

123

View full text Add to dashboard Cite

The BlackEnergy malware targeting critical infrastructures has a long history. It evolved over time from a simple DDoS platform to a quite sophisticated plug-in based malware. The plug-in architecture has a persistent malware core with easily installable attack specific modules for DDoS, spamming, info-stealing, remote access, boot-sector formatting etc. BlackEnergy has been involved in several high profile cyber physical attacks including the recent Ukraine power grid attack in December 2015. This paper investigates the evolution of BlackEnergy and its cyber attack capabilities. It presents a basic cyber attack model used by BlackEnergy for targeting industrial control systems. In particular, the paper analyzes cyber threats of BlackEnergy for synchrophasor based systems which are used for real-time control and monitoring functionalities in smart grid. Several BlackEnergy based attack scenarios have been investigated by exploiting the vulnerabilities in two widely used synchrophasor communication standards: (i) IEEE C37.118 and (ii) IEC 61850-90-5. Specifically, the paper addresses reconnaissance, DDoS, man-in-the-middle and replay/reflection attacks on IEEE C37.118 and IEC 61850-90-5. Further, the paper also investigates protection strategies for detection and prevention of BlackEnergy based cyber physical attacks.

show abstract

“…There are also number of available surveys analyzing cyber threats relevant to smart grid in general, PMU network, and/or synchrophasor applications [11], [12], [13], [14], [15].…”

Section: Related Workmentioning

confidence: 99%

IEEE C37.118-2 Synchrophasor Communication Framework - Overview, Cyber Vulnerabilities Analysis and Performance Evaluation

Khan¹,

McLaughlin²,

Laverty³

et al. 2016

Proceedings of the 2nd International Conference on Information Systems Security and Privacy

View full text Add to dashboard Cite

Abstract-Synchrophasors have become an important part of the modern power system and numerous applications have been developed covering wide-area monitoring, protection and control. Most applications demand continuous transmission of synchrophasor data across large geographical areas and require an efficient communication framework. IEEE C37.118-2 evolved as one of the most successful synchrophasor communication standards and is widely adopted. However, it lacks a predefined security mechanism and is highly vulnerable to cyber attacks. This paper analyzes different types of cyber attacks on IEEE C37.118-2 communication system and evaluates their possible impact on any developed synchrophasor application. Further, the paper also recommends an efficent security mechanism that can provide strong protection against cyber attacks. Although, IEEE C37.118-2 has been widely adopted, there is no clear understanding of the requirements and limitations. To this aim, the paper also presents detailed performance evaluation of IEEE C37.118-2 implementations which could help determine required resources and network characteristics before designing any synchrophasor application.

show abstract

A survey of electric power synchrophasor network cyber security

Cited by 49 publications

References 21 publications

Using Markov Models and Statistics to Learn, Extract, Fuse, and Detect Patterns in Raw Data

Using Markov Models and Statistics to Learn, Extract, Fuse, and Detect Patterns in Raw Data

Threat Analysis of BlackEnergy Malware for Synchrophasor based Real-time Control and Monitoring in Smart Grid

IEEE C37.118-2 Synchrophasor Communication Framework - Overview, Cyber Vulnerabilities Analysis and Performance Evaluation

Contact Info

Product

Resources

About