DefRec: Establishing Physical Function Virtualization to Disrupt Reconnaissance of Power Grids' Cyber-Physical Infrastructures

Abstract

Reconnaissance is critical for adversaries to prepare attacks causing physical damage in industrial control systems (ICS) like smart power grids. Disrupting reconnaissance is challenging. The state-of-the-art moving target defense (MTD) techniques based on mimicking and simulating system behaviors do not consider the physical infrastructure of power grids and can be easily identified. To overcome these challenges, we propose physical function virtualization (PFV) that "hooks" network interactions with real physical devices and uses these real devices to build lightweight virtual nodes that follow the actual implementation of network stacks, system invariants, and physical state variations in the real devices. On top of PFV, we propose DefRec, a defense mechanism that significantly increases the effort required for an adversary to infer the knowledge of power grids' cyber-physical infrastructures. By randomizing communications and crafting decoy data for virtual nodes, DefRec can mislead adversaries into designing damage-free attacks. We implement PFV and DefRec in the ONOS network operating system and evaluate them in a cyber-physical testbed, using real devices from different vendors and HP physical switches to simulate six power grids. The experimental results show that with negligible overhead, PFV can accurately follow the behavior of real devices. DefRec can delay adversaries' reconnaissance for more than 100 years by adding a number of virtual nodes less than or equal to 20% of the number of real devices.

DecIED: Scalable k-Anonymous Deception for IEC61850-Compliant Smart Grid Systems

“…Recently, deception technology for modernized substation systems is proposed by Lin et al [43]. Their proposed technology utilizes software-defined networking and "seed devices", which are real power grid devices but, behind SDN (software-defined networking), interact with attackers on behalf of virtual, decoy devices to present realistic device characteristics, etc.…”

Kalman filter based method for tracking dynamic transmission line parameters

“…Transmission line parameters are critical information for various power system applications including fault location and classification [1][2][3], relay protection [4][5][6], and other applications [7,8]. Thus, the accuracy of line parameters is important, and accurate line parameter estimation methods are demanded.…”

HRPDF: A Software-Based Heterogeneous Redundant Proactive Defense Framework for Programmable Logic Controller

“…Although being effective in some settings, existing defense approaches against PLC-oriented attacks have the following key limitations. Firstly, defending approaches adopted by intrusion detection systems (IDSs) [9][10][11] , deception defense [12][13][14] and attestation [15][16][17][18][19] take effect after attacks happened, mainly detecting them but not blocking them, while blocking technologies such as industrial firewalls alone are not able to effectively block growing sophisticated attacks [20][21][22] . Secondly, most existing approaches are designed based on the characteristics of one or several specific kinds of known attacks, such as [9,13,15].…”

“…Firstly, defending approaches adopted by intrusion detection systems (IDSs) [9][10][11] , deception defense [12][13][14] and attestation [15][16][17][18][19] take effect after attacks happened, mainly detecting them but not blocking them, while blocking technologies such as industrial firewalls alone are not able to effectively block growing sophisticated attacks [20][21][22] . Secondly, most existing approaches are designed based on the characteristics of one or several specific kinds of known attacks, such as [9,13,15]. Thirdly, most existing approaches are hardware-based and require external devices, such as [11,13,17], which are costly, and difficult to deploy and update, especially in a deployed distributed control system (DCS).…”

“…Secondly, most existing approaches are designed based on the characteristics of one or several specific kinds of known attacks, such as [9,13,15]. Thirdly, most existing approaches are hardware-based and require external devices, such as [11,13,17], which are costly, and difficult to deploy and update, especially in a deployed distributed control system (DCS). Specifically, large-scale DCSs often have multiple controllers that are scattered everywhere, and hardware-based approaches may need to monitor the I/O interface of each controller and the network connecting controllers.…”