Situational Awareness Network for the Electric Power System: the Architecture and Testing Metrics

Abstract

Abstract-The contemporary electric power system is highly dependent on Information and Communication Technologies which results in its exposure to new types of threats, such as Advanced Persistent Threats (APT) or Distributed-Denial-of-Service (DDoS) attacks. The most exposed components are Industrial Control Systems in substations and Distributed Control Systems in power plants. Therefore, it is necessary to ensure the cyber security of this critical infrastructure and develop new cyber security technologies able to protect from advanced cyber threats. In this paper a pioneering Situation Awareness Network for the electric power system is presented together with a set of metrics for its testing.

Threat intelligence platform for the energy sector

“…The TI area, however, due to its novelty, required new consideration. When introducing metrics, specific criteria were taken into account, namely the metric should: enable consistent measuring be expressed as a cardinal number or percentage be represented in units of measure be contextually specific be achievable at a reasonable cost be straightforwardly implementable in the TI context at every stage of development …”

“…Three categories of metrics have been proposed: testing process metrics , cybersecurity metrics , and usability metrics . Testing process metrics facilitate the control and management of a testing procedure.…”

“…These methods deliver clusters of information that at a higher level still need to be analyzed by humans . Situation awareness networks (SANs) are technical architectures designed to provide SA by combining multiple sensors deployed in various system locations …”

“…SANs are technical architectures designed to provide SA by combining multiple sensors deployed in various system locations . Conceptually, SANs are the direct instantiation of the collaborative security paradigm.…”

“…A specialized SAN architecture was designed, which takes advantage of SIEM systems as well as diverse types of sensors, including communication protocols dedicated to energy systems . Data processing techniques, including data correlation (see Section 5.3), are implemented to reduce the number of false positives, increase detection efficiency, and facilitate the comprehension of reported information by human operators.…”