Visible to the public Integrated Anomaly Detection for Cyber Security of the Substations

TitleIntegrated Anomaly Detection for Cyber Security of the Substations
Publication TypeJournal Article
Year of Publication2014
AuthorsJunho Hong, Chen-Ching Liu, Govindarasu, M.
JournalSmart Grid, IEEE Transactions on
Date PublishedJuly
KeywordsADS, anomaly detection, catastrophic power outages, circuit breakers, computer network security, computer security, cyber intrusions, cyber security of substations, generic object oriented substation event, GOOSE, GOOSE anomaly detection, host-based anomaly detection systems, IED, integrated anomaly detection system, intelligent electronic devices, Intrusion detection, malicious behaviors, multicast messages, network-based anomaly detection systems, physical security, power engineering computing, power grid, power grids, power system reliability, sampled measured value, severe cascading events, simultaneous anomaly detection, simultaneous intrusion detection method, SMV, SMV anomaly detection and intrusion detection, substation automation, substation automation testbed, substation facilities, Substations, temporal anomalies, user-interfaces

Cyber intrusions to substations of a power grid are a source of vulnerability since most substations are unmanned and with limited protection of the physical security. In the worst case, simultaneous intrusions into multiple substations can lead to severe cascading events, causing catastrophic power outages. In this paper, an integrated Anomaly Detection System (ADS) is proposed which contains host- and network-based anomaly detection systems for the substations, and simultaneous anomaly detection for multiple substations. Potential scenarios of simultaneous intrusions into the substations have been simulated using a substation automation testbed. The host-based anomaly detection considers temporal anomalies in the substation facilities, e.g., user-interfaces, Intelligent Electronic Devices (IEDs) and circuit breakers. The malicious behaviors of substation automation based on multicast messages, e.g., Generic Object Oriented Substation Event (GOOSE) and Sampled Measured Value (SMV), are incorporated in the proposed network-based anomaly detection. The proposed simultaneous intrusion detection method is able to identify the same type of attacks at multiple substations and their locations. The result is a new integrated tool for detection and mitigation of cyber intrusions at a single substation or multiple substations of a power grid.

Citation Key6786500