A survey on intrusion detection and prevention systems in digital substations

Quincozes, Silvio E.; Albuquerque, Célio; Passos, Diego; Mossé, Daniel

doi:10.1016/j.comnet.2020.107679

Cited by 63 publications

(30 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Many papers have studied the security and privacy issues of SG. Some of them are listed in [2,11,[15][16][17][18][19][20]. In particular, in [11], the authors provide a comprehensive survey regarding the intrusion detection in the SG sector.…”

Section: Related Workmentioning

confidence: 99%

“…In particular, the authors focus on FDI attacks against (a) energy consumption data, (b) state estimation and (c) load forecasting. In [17], S. Quincozes et al provide a survey about the intrusion detection and prevention mechanisms concerning the digital substations. M. Gunduz and R. Das in [18] investigate the various threats in SG, providing the corresponding solutions and directions for future work.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

SPEAR SIEM: A Security Information and Event Management system for the Smart Grid

et al. 2021

View full text Add to dashboard Cite

The technological leap of smart technologies has brought the conventional electrical grid in a new digital era called Smart Grid (SG), providing multiple benefits, such as two-way communication, pervasive control and self-healing. However, this new reality generates significant cybersecurity risks due to the heterogeneous and insecure nature of SG. In particular, SG relies on legacy communication protocols that have not been implemented having cybersecurity in mind. Moreover, the advent of the Internet of Things (IoT) creates severe cybersecurity challenges. The Security Information and Event Management (SIEM) systems constitute an emerging technology in the cybersecurity area, having the capability to detect, normalise and correlate a vast amount of security events. They can orchestrate the entire security of a smart ecosystem, such as SG. Nevertheless, the current SIEM systems do not take into account the unique SG peculiarities and characteristics like the legacy communication protocols. In this paper, we present the Secure and PrivatE smArt gRid (SPEAR) SIEM, which focuses on SG. The main contribution of our work is the design and implementation of a SIEM system capable of detecting, normalising and correlating cyberattacks and anomalies against a plethora of SG application-layer protocols. It is noteworthy that the detection performance of the SPEAR SIEM is demonstrated with real data originating from four real SG use case (a) hydropower plant, (b) substation, (c) power plant and (d) smart home.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

SPEAR SIEM: A Security Information and Event Management system for the Smart Grid

et al. 2021

View full text Add to dashboard Cite

show abstract

“…Much research has been done in recent years on developing intrusion detection mechanisms for SCADA systems. For instance, see some relevant survey papers [40][41][42][43][44].…”

Section: Related Workmentioning

confidence: 99%

A stacked deep learning approach to cyber-attacks detection in industrial systems: application to power system and gas pipeline systems

Harrou

Bouyeddou

et al. 2021

Cluster Comput

View full text Add to dashboard Cite

Presently, Supervisory Control and Data Acquisition (SCADA) systems are broadly adopted in remote monitoring large-scale production systems and modern power grids. However, SCADA systems are continuously exposed to various heterogeneous cyberattacks, making the detection task using the conventional intrusion detection systems (IDSs) very challenging. Furthermore, conventional security solutions, such as firewalls, and antivirus software, are not appropriate for fully protecting SCADA systems because they have distinct specifications. Thus, accurately detecting cyber-attacks in critical SCADA systems is undoubtedly indispensable to enhance their resilience, ensure safe operations, and avoid costly maintenance. The overarching goal of this paper is to detect malicious intrusions that already detoured traditional IDS and firewalls. In this paper, a stacked deep learning method is introduced to identify malicious attacks targeting SCADA systems. Specifically, we investigate the feasibility of a deep learning approach for intrusion detection in SCADA systems. Real data sets from two laboratory-scale SCADA systems, a two-line three-bus power transmission system and a gas pipeline are used to evaluate the proposed method’s performance. The results of this investigation show the satisfying detection performance of the proposed stacked deep learning approach. This study also showed that the proposed approach outperformed the standalone deep learning models and the state-of-the-art algorithms, including Nearest neighbor, Random forests, Naive Bayes, Adaboost, Support Vector Machine, and oneR. Besides detecting the malicious attacks, we also investigate the feature importance of the cyber-attacks detection process using the Random Forest procedure, which helps design more parsimonious models.

show abstract

“…Among the discussed cyber defense measures, the authors focus on means for ensuring physical cybersecurity, recommendations for mitigating risks in space-based and radio communication, email and browser protection, and the adoption of Intrusion Detecting System (IDS). Note that IDSs and other standalone attack detection methods [ 15 ] are extensively used in IT [ 16 , 17 ] and OT [ 18 ] networks and can bring benefits to the security of networked ship systems.…”

Section: Related Workmentioning

confidence: 99%

A Triggering Mechanism for Cyber-Attacks in Naval Sensors and Systems

Leite

Moraes

Albuquerque

et al. 2021

Sensors

View full text Add to dashboard Cite

In the maritime sector, the integration of radar systems, Automatic Identification System (AIS) and Electronic Chart Display and Information System (ECDIS) through digital technologies enables several benefits to maritime operations, but also make ships prone to cyberattacks. In this context, this work investigates the feasibility of an attacker using a radar system or AIS as open door to remotely send commands to a cyber threat hosted on a ship, even if the ship’s systems are air gapped—i.e., are not connected to other networks. The received commands are intended to trigger a cyber threat located in the ship. Although the literature covers several analyzes on cyber risks and vulnerabilities in naval systems, it lacks exploiting mechanisms capable of acknowledging attack commands received through radar and AIS. To this end, this work proposes a triggering mechanism that uses a template matching technique to detect specific patterns transmitted by the attacker to the ship’s radar or AIS. The results show the effectiveness of the proposed technique as a tool to acknowledge the received attack commands and activate a malicious code previously installed on the ship. In the case of attacks on a radar system, the accuracy achieved by the proposed method is 0.90. In the case of attacks on an AIS/ECDIS setup it presents an accuracy of 0.93. In both cases the proposed mechanism maintains the due safety against accidental attack activations.

show abstract

A survey on intrusion detection and prevention systems in digital substations

Cited by 63 publications

References 22 publications

SPEAR SIEM: A Security Information and Event Management system for the Smart Grid

SPEAR SIEM: A Security Information and Event Management system for the Smart Grid

A stacked deep learning approach to cyber-attacks detection in industrial systems: application to power system and gas pipeline systems

A Triggering Mechanism for Cyber-Attacks in Naval Sensors and Systems

Contact Info

Product

Resources

About