DDoS Cyber-Incident Detection in Smart Grids

Abstract

The smart grid (SG) offers potential benefits for utilities, electric generators, and customers alike. However, the prevalence of cyber-attacks targeting the SG emphasizes its dark side. In particular, distributed denial-of-service (DDoS) attacks can affect the communication of different devices, interrupting the SG’s operation. This could have profound implications for the power system, including area blackouts. The problem is that few operational technology tools provide reflective DDoS protection. Furthermore, such tools often fail to classify the types of attacks that have occurred. Defensive capabilities are necessary to identify the footprints of attacks in a timely manner, as they occur, and to make these systems sustainable for delivery of the services as expected. To meet this need for defensive capabilities, we developed a situational awareness tool to detect system compromise by monitoring the indicators of compromise (IOCs) of amplification DDoS attacks. We achieved this aim by finding IOCs and exploring attack footprints to understand the nature of such attacks and their cyber behavior. Finally, an evaluation of our approach against a real dataset of DDoS attack instances indicated that our tool can distinguish and detect different types of amplification DDoS attacks.

2019–2023 in Review: Projecting DDoS Threats With ARIMA and ETS Forecasting Techniques

“…Below is brief description of each of these final selected studies: 1) Brooks et al, [30] provides an overview of the technologies and tools used in Distributed Denial of Service (DDoS) attacks, traces their historical timeline, discusses their evolution from hacker culture to commercial and political exploitation, and examines how the Internet's structure enables these attacks. 2) Merlino et al, [31] discusses the development of a situational awareness tool designed to detect and understand amplification DDoS attacks on the smart grid, highlighting the tool's effectiveness against real attack instances and the need for defensive capabilities in cyber-attack identification. 3) Patil et al, [32] provides a comprehensive review of existing distributed frameworks for DDoS attack detection, evaluates their effectiveness, and discusses open issues, datasets, and future directions in enhancing web-based application defenses against growing DDoS threats.…”

A Survey of DDOS Attack Detection Techniques for IoT Systems Using BlockChain Technology

“…Therefore, the detection of DDoS attacks becomes the need of the hour to invoke a defensive system so that we can run our power and smart grid systems continuously and without disruptions. Work in [37] focuses on three indicators of compromise responsible for the DDoS attacks: (1) The response size of the power request, which would become abnormally large, hence signaling that a DDoS attack is in progress; (2) a mismatch in the application's port number, which means the use of an unusual port [38] instead of a well-known port (e.g., port#80) by an application server such as HTTP [38], thus being an indication of a DDoS attack before assuming that the unusual port number is under the influence of an attacker's bot, we must first confirm that this port is sending enormous traffic to the targeted server; and (3) locating an IP address sending multiple packets to the targeted server in a short time interval is also a sign of a DDoS attack.…”

Detection of cyber-attacks on smart grids using improved VGG19 deep neural network architecture and Aquila optimizer algorithm

“…Estimates show that a cyber attack on London's electricity network caused a loss of around 111 million pounds per day. The mentioned attacks negatively affected the lives of 1.5 million people [16]. With the digital development of smart grids, their level of vulnerability has increased, so it is necessary to provide intelligent approaches to deal with these attacks.…”