Testbed-based Evaluation of SIEM Tool for Cyber Kill Chain Model in Power Grid SCADA System

Abstract

Development of a smarter electric grid necessitates addressing the associated cyber security challenges. Since the interdependence between the legacy grid infrastructure and advanced information technology is growing rapidly, there are numerous ways advanced, motivated, and persistent attackers can affect the SCADA based critical infrastructure. Hence, developing a security information and event management (SIEM) is crucial for securing the SCADA power system. This paper presents the application of Security Onion (SecOn) to develop the network security monitoring (NSM) and intrusion detection system (IDS) in the context of SCADA cyber physical security. Initially, we have applied a cyber kill-chain model to demonstrate the different stages of attacks and associated mechanisms. Later, the rulebased IDS (RIDS) is developed using Snort IDS, and tested in the cyber-physical SCADA environment. Furthermore, we have evaluated its performance in terms of accuracy and detection latency. Our experimental results reveal that the SecOn tool is efficient in monitoring and detecting attacks within an acceptable time frame with a high accuracy rate. Disciplines Disciplines Electrical and Computer Engineering Comments Comments This proceeding is published as Singh, Vivek Kumar, Steven Perez Callupe, and Manimaran Govindarasu. "Testbed-based Evaluation of SIEM Tool for Cyber Kill Chain Model in Power Grid SCADA System." (2019). Posted with permission.

Cyber Kill Chain-Based Hybrid Intrusion Detection System for Smart Grid

“…Although the centralized IDS is developed pertinent to the energy management system (EMS) applications like state estimation, automatic generation controller (AGC), etc., the multi-agents-based distributed IDS is also proposed in [12] to avoid a single point of failure while detecting anomalies in the decentralized protection scheme. Apart from the anomaly-based IDSs, several signature-based IDSs [13]- [16] are also proposed that perform deep packet inspection on the SCADA and synchrophasor communication protocols to detect cyber intrusions in real-time. Further, in [14], the authors show how two open-source IDS tools-Snort and BRO, can be utilized in detecting a data integrity attack using the timing information of two consecutive network packets and compared their performances in terms of accuracy and latency rates.…”

“…Several tools, tactics, and procedures (TTP) can be utilized in a sequence of steps as per the attack mechanism to perform successful stealthy cyber-attacks. The model consists of various processes or stages that are elaborated here, as discussed in [13]. 1.…”

“…In this table, rule 1 and rule 2 belong to the reconnaissance (stage 1), rule 3 belongs to the access (stage 2), and rule 4 belongs to the launch stage (stage3). Note that we have utilized the Snort IDS tool to analyze the SCADA traffic through network interfaces and later develop these rules as discussed in [13].…”

Attack resilient algorithms and testbed federation for wide-area protection and control in smart grid

“…Detection (Defense) Module: It includes state-of-the-art detection and defense solutions, such as rule, model, and machine learning-based anomaly detection systems (ADSs), moving target defense (MTD), etc., as developed in earlier research efforts [41], [42], [44], which can be utilized to test, validate, and evaluate system performances with a detailed network analysis in this federated testbed environment.…”

“…1. IT-Based Attacks: IT-based attacks include traditional host and network-based attacksincluding scanning attacks (e.g., ping and Network Mapper (NMAP) scanning), DoS attacks, and spoofing attacks (e.g., IP spoofing, ARP poisoning)-that can be deployed in the SCADA environment to develop a blueprint of the network architecture and compromise power system devices [41].…”