SPEAR SIEM: A Security Information and Event Management system for the Smart Grid

Abstract

The technological leap of smart technologies has brought the conventional electrical grid in a new digital era called Smart Grid (SG), providing multiple benefits, such as two-way communication, pervasive control and self-healing. However, this new reality generates significant cybersecurity risks due to the heterogeneous and insecure nature of SG. In particular, SG relies on legacy communication protocols that have not been implemented having cybersecurity in mind. Moreover, the advent of the Internet of Things (IoT) creates severe cybersecurity challenges. The Security Information and Event Management (SIEM) systems constitute an emerging technology in the cybersecurity area, having the capability to detect, normalise and correlate a vast amount of security events. They can orchestrate the entire security of a smart ecosystem, such as SG. Nevertheless, the current SIEM systems do not take into account the unique SG peculiarities and characteristics like the legacy communication protocols. In this paper, we present the Secure and PrivatE smArt gRid (SPEAR) SIEM, which focuses on SG. The main contribution of our work is the design and implementation of a SIEM system capable of detecting, normalising and correlating cyberattacks and anomalies against a plethora of SG application-layer protocols. It is noteworthy that the detection performance of the SPEAR SIEM is demonstrated with real data originating from four real SG use case (a) hydropower plant, (b) substation, (c) power plant and (d) smart home.

Blockchain-Based Smart Renewable Energy: Review of Operational and Transactional Challenges

“…Although the modern electrical grid has many advantages, such as ubiquitous control and self-healing, it poses significant cybersecurity concerns. The combination of unsecured communication protocols, IoT security vulnerabilities, and the rapid advancement of cyberattacks and malware, in particular, might have severe results, including widespread blackouts and brownouts [90]. Exploring blockchain cyber risks, vulnerabilities, and mitigations in the context of safeguarding the grid's edge and offering more secure transactive energy solutions would be a massive benefit to grid cybersecurity and resilience research [47].…”

On Holistic Multi-Step Cyberattack Detection via a Graph-based Correlation Approach

“…IDS, firewalls, etc), normalization of the data to a common format and finally synchronization of associated event fields (e.g. timestamps) for further data processing and for performing alert correlation [18], [19]. Apart from data gathering, attack modeling is also important for contextual detection.…”

Security Information and Event Management (SIEM): Analysis, Trends, and Usage in Critical Infrastructures

“…SIEM challenges will continue to evolve as security managers grapple with cloud services, mobile, the Internet of Things, and other new technologies the IT department does not always control. IoT will be a huge factor as it drives the number of endpoints vulnerable to attackers [ 111 , 112 ]. It gets harder for cybercriminals to infiltrate computers but is still fairly easy to hack cameras, refrigerators, microwaves, Bluetooth tools, and other connected devices and use them as an attack vector.…”