Bloom filter based intrusion detection for smart grid SCADA

Abstract

In this paper, we propose a distributed, light-weight and fast intrusion detection approach suitable for implementation across multiple resource constrained SCADA field devices in the smart grid. The predictable and regular nature of the SCADA communication patterns is exploited to detect intrusions in the field devices. The novel approach is anomaly-based, uses the Bloom filter data structure for memory efficiency and incorporates the physical state of the power system for greater robustness. The proposed method is tested using MODBUS protocol used for communication between a SCADA server and field devices in a SCADA system.Index Terms-Bloom filter, intrusion detection, smart grid SCADA IDS.

SRID: State Relation Based Intrusion Detection for False Data Injection Attacks in SCADA

“…In the first category, existing approaches [13,6,21,10,17,18] monitor the abnormal behaviors using predefined rules to detect attacks. SmartAnalyzer [18,14,19,17] detects possible attacks on advanced metering infrastructure (AMI).…”

“…Another behavior-rule based intrusion detection system, BRIDS [14], is proposed to secure the SCADA system in a distributed way. In [21], an idea of using bloomer-filter to detect intrusion in resource-constrained devices is proposed.…”

“…Multiple schemes, such as behavior-based scheme [14] and bloom-filter-based scheme [21], have been proposed. However, when we review the recent intrusion incidents conducted by targeted malware, such as the infamous Stuxnet malware, we find these IDS schemes are neither complete nor accurate.…”

“…Multiple different detection models, such as statistic-based [15], behavior-based [14] and bloom-filter-based [21], have been proposed. However, as a highly complicated control system, deploying similar or identical rules on different control components is not an ideal choice.…”

“…Advanced false data injection attack in targeted malware intrusion is becoming an emerging severe threat to the Supervisory Control And Data Acquisition (SCADA) system. Several intrusion detection schemes have been proposed previously [21,3]. However, designing an effective real-time detection system for a resource-constraint device is still an open problem for the research community.…”