Design and evaluation of a cyber‐physical testbed for improving attack resilience of power systems

Sahu, Abhijeet; Wlazlo, Patrick; Mao, Zeyu; Huang, Hao; Goulart, Ana; Davis, Katherine; Zonouz, Saman

doi:10.1049/cps2.12018

Cited by 32 publications

(35 citation statements)

References 46 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This section describes the experiments performed on evaluating the performance of IDEA-I on the data collected from the sensors in the RESLab testbed [22], where different Man-In-The-Middle attacks were implemented in the emulated synthetic electric grid. Different rules of combination and decision criteria are evaluated from the DSTE.…”

Section: Results and Analysismentioning

confidence: 99%

“…1. The Datasets are sensor data extracted from substation networking devices, DNP3 Master and Outstations from the RESLab testbed [22]. DNP3 [32]…”

Section: Development Of Idea-i From Dempster Shafermentioning

confidence: 99%

“…A brief overview of each component is given below. The detailed explanation of RESLab, including its architecture and use cases, is provided in [22], [36]. Common Open Research Emulator (CORE) is used to emulate the communication network.…”

Section: A Testbed Architecturementioning

confidence: 99%

“…The objective of the intruder is to disrupt grid operations. Details on the sequence of actions that create the FCI and FDI attacks and how they impact the power system side are detailed in [22], [36]. These are four use cases:…”

Section: B Modifying Measurements and Commandsmentioning

confidence: 99%

“…The presented work, IDEA-I, is the first to leverage DS theory for the purpose of classification based on the dataset [12] generated from MiTM attacks in a cyber-physical power system testbed [22].…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Inter-Domain Fusion for Enhanced Intrusion Detection in Power Systems: An Evidence Theoretic and Meta-Heuristic Approach

Sahu,

Davis

2021

Preprint

Self Cite

View full text Add to dashboard Cite

False alerts due to misconfigured or compromised intrusion detection systems (IDS) in industrial control system (ICS) networks can lead to severe economic and operational damage. To solve this problem, research has focused on leveraging deep learning techniques that would help reduce false alerts. However, a shortcoming is that these works often require or implicitly assume the physical and cyber sensor data to be trustworthy. Implicit trust of data is a major problem with using artificial intelligence or machine learning (AI/ML) for cyber-physical system (CPS) security, because the times when these solutions are needed most to detect an attack are also the times when they are more at risk, with both greater likelihood and greater impact, of also being compromised. To address this inevitable shortcoming, the problem can thus be reframed as how to make good decisions given uncertainty. Then, the decision is detection, and the uncertainty includes whether or not the data that would be used in ML-based IDS is compromised. Thus, this article presents an approach for reducing false alerts in cyber-physical power systems that addresses this critical problem of dealing with uncertainty without the knowledge of prior distribution of the alerts. Specifically, an evidence theoretic based approach leveraging Dempster Shafer (DS) combination rules and their variants is proposed for reducing false alerts. A multi-hypothesis mass function model is designed that leverages probability scores obtained from various supervised-learning classifiers. Using this model, a location-cum-domain based fusion framework is proposed to evaluate the intrusion detector's performance using Disjunctive, Conjunctive and Cautious Conjunctive rules of combinations, that fuse multiple piece of evidences from inter-domain and intradomain sensors. The approach is demonstrated in a cyber-physical power system testbed (RESLab), and the classifiers are trained with datasets from Man-In-The-Middle attack emulation in a large-scale synthetic electric grid. For evaluating the performance, we consider plausibility, belief, pignistic, general Bayesian theorem based metrics as decision functions. To improve the performance, a multi-objective based genetic algorithm is proposed for feature selection considering the decision metrics as the fitness function. Finally, we present a software application to evaluate the DS fusion approaches with different parameters and architectures.

show abstract

Section: Results and Analysismentioning

confidence: 99%

“…1. The Datasets are sensor data extracted from substation networking devices, DNP3 Master and Outstations from the RESLab testbed [22]. DNP3 [32]…”

Section: Development Of Idea-i From Dempster Shafermentioning

confidence: 99%