CAPTAR: Causal-Polytree-based Anomaly Reasoning for SCADA Networks

Ren, Wenyu; Yu, Tuo; Yardley, Timothy; Nahrstedt, Klara

doi:10.1109/smartgridcomm.2019.8909766

Cited by 11 publications

(6 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…An anomaly reasoning engine is proposed in Ref. [25] that utilizes Bayesian inference on causal polytrees to produce a high‐level view of the security state in a supervisory control and data acquisition (SCADA) network. The work in Bayes‐CAPS is motivated by Refs.…”

Section: Power System Security Inference Backgroundmentioning

confidence: 99%

See 1 more Smart Citation

Inferring adversarial behaviour in cyber‐physical power systems using a Bayesian attack graph approach

Sahu

Davis

2023

IET Cyber-Phy Sys Theory & Ap

View full text Add to dashboard Cite

Highly connected smart power systems are subject to increasing vulnerabilities and adversarial threats. Defenders need to proactively identify and defend new high‐risk access paths of cyber intruders that target grid resilience. However, cyber‐physical risk analysis and defense in power systems often requires making assumptions on adversary behaviour, and these assumptions can be wrong. Thus, this work examines the problem of inferring adversary behaviour in power systems to improve risk‐based defense and detection. To achieve this, a Bayesian approach for inference of the Cyber‐Adversarial Power System (Bayes‐CAPS) is proposed that uses Bayesian networks (BNs) to define and solve the inference problem of adversarial movement in the grid infrastructure towards targets of physical impact. Specifically, BNs are used to compute conditional probabilities to queries, such as the probability of observing an event given a set of alerts. Bayes‐CAPS builds initial Bayesian attack graphs for realistic power system cyber‐physical models. These models are adaptable using collected data from the system under study. Then, Bayes‐CAPS computes the posterior probabilities of the occurrence of a security breach event in power systems. Experiments are conducted that evaluate algorithms based on time complexity, accuracy and impact of evidence for different scales and densities of network. The performance is evaluated and compared for five realistic cyber‐physical power system models of increasing size and complexities ranging from 8 to 300 substations based on computation and accuracy impacts.

show abstract

Section: Power System Security Inference Backgroundmentioning

confidence: 99%

“…The work in Bayes-CAPS is motivated by Refs. [24,25] to propose Bayesian inference algorithms for networks of realistic size and complexity, and to recommend viable inference solutions for these networks using dynamic evidences.…”

Section: Bns In Power Systemsmentioning

confidence: 99%

Inferring adversarial behaviour in cyber‐physical power systems using a Bayesian attack graph approach

Sahu

Davis

2023

IET Cyber-Phy Sys Theory & Ap

View full text Add to dashboard Cite

show abstract

“…Lanoe et al [36] also proposed a rule-based approach for attack-scenario reconstruction. Bayesian classification can also be used to identify predefined scenario attacks in the smart-grid domain [37].…”

Section: Alert Correlationmentioning

confidence: 99%

Cross-domain alert correlation methodology for industrial control systems

Koucham

Mocanu

Hiet

et al. 2022

Computers & Security

View full text Add to dashboard Cite

“…Judea pearl presented the Noisy-OR model to describe a non-deterministic relationship in a causal network [15], [28], [29], while Srinivas Sampath extended this work and presented a generalized Noisy-OR model [18]. Ren et al use the Noisy-OR model and Bayesian inference by belief propagation to detect different types of attack scenarios in the SCADA network [30]. The work described in [30] applies an apriori Bayesian network created by human experts in the field.…”

Section: B Modelling Workmentioning

confidence: 99%

“…Ren et al use the Noisy-OR model and Bayesian inference by belief propagation to detect different types of attack scenarios in the SCADA network [30]. The work described in [30] applies an apriori Bayesian network created by human experts in the field. In contrast, we construct the apriori Bayesian network using insights from extensive laboratory measurements.…”

Section: B Modelling Workmentioning

confidence: 99%

Characterization and Anomaly Reasoning in Signaling & Power Cables

Vijay¹,

Prabhakar²

2022

Preprint

View full text Add to dashboard Cite

<p>Power and signaling infrastructure comprise of electrical installations, electronic systems and cables. A damage to these cables will be catastrophic or at the least significant downtime to the system. Hence, monitoring these cables in real-time not only improves the efficiency of the system but can also avoid fatal accidents. In this work, we develop a non-invasive composite diagnostic framework to identify cable damages such as insulation cuts. The framework can detect, classify, and locate faults. While the solution is general enough, we consider two use cases: (a) railway cables used in signalling applications and(b) symmetrical four-core cables used in residential buildings. In order to characterize the faults, we use three non-invasive sensors: (a) SNR sensor, (b) S-parameter, and (c) Correlation peak sensor. We use a single programmable hardware to implement each of these sensors. These sensors monitor a parameter change on the cable in real-time. The experimental insights gained are used to construct an a priori Bayesian network depicting the non-deterministic relationship between an effect and its causes. This uncertainty is due to inhibitors such as sensor calibration issues and coupling mismatch between sensor transceivers suitably handled through a Noisy-OR function. The results of Bayesian inference with belief propagation provides up to 97% match with the ground truth state. Regarding the cable fault, our experimental results show a best-case detection and localization accuracy of 98% & 97.2% respectively.</p>

show abstract

CAPTAR: Causal-Polytree-based Anomaly Reasoning for SCADA Networks

Cited by 11 publications

References 13 publications

Inferring adversarial behaviour in cyber‐physical power systems using a Bayesian attack graph approach

Inferring adversarial behaviour in cyber‐physical power systems using a Bayesian attack graph approach

Cross-domain alert correlation methodology for industrial control systems

Characterization and Anomaly Reasoning in Signaling & Power Cables

Contact Info

Product

Resources

About