Operational Data Based Intrusion Detection System for Smart Grid

Efstathopoulos, Georgios; Radoglou-Grammatikis, Panagiotis; Sarigiannidis, Panagiotis; Argyriou, Vasilis; Sarigiannidis, Antonios; Stamatakis, Konstantinos; Angelopoulos, Michail; Athanasopoulos, Solon K.

doi:10.1109/camad.2019.8858503

Cited by 31 publications

(14 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…In [30], the authors introduce an anomaly-based IDS for the electrical grid, based on operational data of a real power plant. The proposed IDS consists of two primary stages The main innovation of this work lies in the fact that the Pre-Processing Module (in both stages) adopts a complex data representation, which results in better detection performance.…”

Section: Related Workmentioning

confidence: 99%

SPEAR SIEM: A Security Information and Event Management system for the Smart Grid

et al. 2021

Self Cite

View full text Add to dashboard Cite

The technological leap of smart technologies has brought the conventional electrical grid in a new digital era called Smart Grid (SG), providing multiple benefits, such as two-way communication, pervasive control and self-healing. However, this new reality generates significant cybersecurity risks due to the heterogeneous and insecure nature of SG. In particular, SG relies on legacy communication protocols that have not been implemented having cybersecurity in mind. Moreover, the advent of the Internet of Things (IoT) creates severe cybersecurity challenges. The Security Information and Event Management (SIEM) systems constitute an emerging technology in the cybersecurity area, having the capability to detect, normalise and correlate a vast amount of security events. They can orchestrate the entire security of a smart ecosystem, such as SG. Nevertheless, the current SIEM systems do not take into account the unique SG peculiarities and characteristics like the legacy communication protocols. In this paper, we present the Secure and PrivatE smArt gRid (SPEAR) SIEM, which focuses on SG. The main contribution of our work is the design and implementation of a SIEM system capable of detecting, normalising and correlating cyberattacks and anomalies against a plethora of SG application-layer protocols. It is noteworthy that the detection performance of the SPEAR SIEM is demonstrated with real data originating from four real SG use case (a) hydropower plant, (b) substation, (c) power plant and (d) smart home.

show abstract

Section: Related Workmentioning

confidence: 99%

SPEAR SIEM: A Security Information and Event Management system for the Smart Grid

et al. 2021

Self Cite

View full text Add to dashboard Cite

show abstract

“…Some of the highlighted requirements and challenges are scalability, authentication, integrity, availability and resilience [118,154,155,164,167,169,171]. Similar to what happens for IoT, most of research works are focused in IDS proposals [12,134,153] and attacks/anomaly detection (mainly ML-based) [136,140,172].…”

Section: Iot and Iiotmentioning

confidence: 99%

Present and Future of Network Security Monitoring

2021

View full text Add to dashboard Cite

Network Security Monitoring (NSM) is a popular term to refer to the detection of security incidents by monitoring the network events. An NSM system is central for the security of current networks, given the escalation in sophistication of cyberwarfare. In this paper, we review the state-of-the-art in NSM, and derive a new taxonomy of the functionalities and modules in an NSM system. This taxonomy is useful to assess current NSM deployments and tools for both researchers and practitioners. We organize a list of popular tools according to this new taxonomy, and identify challenges in the application of NSM in modern network deployments, like Software Defined Network (SDN) and Internet of Things (IoT).

show abstract

“…Machine learning techniques were considered as the most innovative method in anomaly detection [18]. Efstathopolous et al [13] presented a comparative analysis of a supervised machine learning algorithm that includes One Class-SVM, Isolation Forest, Angle-Base Outlier (ABOD). Stochastic Outlier Selection (SOS), and Principal Component Analysis (PCA) for detecting an anomaly in the Smart Grid environment.…”

Section: Related Workmentioning

confidence: 99%

SGF-MD: Behavior Rule Specification-Based Distributed Misbehavior Detection of Embedded IoT Devices in a Closed-Loop Smart Greenhouse Farming System

et al. 2020

View full text Add to dashboard Cite

Smart farming is rapidly revolutionizing the agricultural sector where embedded Internet of Things (IoT) devices are integrated into the field to maintain or improve the quality of products as well as increase food production. Despite the tremendous benefits, various cybersecurity threats of IoT can also be inherited by the sector. In this paper, we propose a lightweight specification-based distributed detection to identify the misbehavior of heterogeneous embedded IoT nodes efficiently and effectively in a closed-loop smart greenhouse farming system. To expand the monitoring space of a node, we exploited the Kalman-filter algorithm and simple statistical operations to obtain estimates of data. Accordingly, this enables a monitoring node to assess a target node that has distinct physical characteristics and access to natural phenomena. Along with this, we derive the behavior-rules that are specific to the target system and carefully translate these rules into a state machine diagram. Besides, we formally verify the functional correctness of the monitoring processes as well as ensure that the behavior specifications are completely covered by using the model checker tool UPPAAL. Through extensive experimental simulation using Proteus, we verify its applicability to resource-constrained embedded devices, e.g., Arduino-Uno, as well as show high accuracy in detecting misbehaving nodes while having low false alarms.

show abstract

Operational Data Based Intrusion Detection System for Smart Grid

Cited by 31 publications

References 29 publications

SPEAR SIEM: A Security Information and Event Management system for the Smart Grid

SPEAR SIEM: A Security Information and Event Management system for the Smart Grid

Present and Future of Network Security Monitoring

SGF-MD: Behavior Rule Specification-Based Distributed Misbehavior Detection of Embedded IoT Devices in a Closed-Loop Smart Greenhouse Farming System

Contact Info

Product

Resources

About