Embedded Cyber-Physical Anomaly Detection in Smart Meters

Abstract

Abstract. Smart grid security has many facets, ranging over a spectrum from resisting attacks aimed at supervisory and control systems, to end user privacy concerns while monitored by the utility enterprise. This multi-faceted problem also includes vulnerabilities that arise from deployment of local cyber-physical attacks at a smart metering location, with a potential to a) manipulate the measured energy consumption, and b) being massively deployed aiming at destabilisation. In this paper we study a smart metering device that uses a trusted platform for storage and communication of metering data, and show that despite the hard core security, there is still room for deployment of a second level of defence as an embedded real-time anomaly detector that can cover both the cyber and physical domains.

Trading off Latency Against Security in Open Energy Metering Infrastructures

“…Raciti and Nadjm-Tehrani (2013) propose an architecture for embedded anomaly detection in smart meters and create an instance of a clusteringbased anomaly detection algorithm in a prototype meter. Tudor et al (2015) investigate the need to monitor encrypted traffic in a smart metering infrastructure.…”

Security in Embedded Systems: A Model-Based Approach with Risk Metrics

“…In particular, an expert needs to extend the ToEParameter, DomainMetrics, and ResourceMetrics stereotypes. be characterised by the number of clusters (numberOfClusters) and cluster centroid distance threshold (clusterDistanceThreshold ) [81], while a cipher building block can be characterised by its key size (keySize), cipher mode (cipherMode), and cipher type (cipherType). Quality of service metrics for an anomaly detection are detection rate and false positive rate (see DM Anomaly) and for a cipher they are resistance to attacker's capabilities in terms of its skill, motivation, and duration of the attack(see DM Cipher ), and etc.…”

“…Secure storage and security communication reduce the likelihood of breaching integrity and confidentiality of stored data and transmitted data respectively. The anomaly detection [81] aims to reduce the likelihood of integrity loss for measurements stored in the device. Reduction effect of implemented SBBs is visualised in Figure 6.3 as arrows that shift the initial confidentiality loss to lower values 2 .…”

METIS: A Two-Tier Intrusion Detection System for Advanced Metering Infrastructures

“…In this case, the devices should be instructed to report their communication exchanges to the head-end (at least, the ones that are required to detect a given attack). On the other extreme, the computation could be performed by the AMI's devices themselves, as investigated recently in [20]. This option would also be limited by the computational resources of the devices.…”

“…For this reason, the Probabilistic Filter compares each tuple produced by the Data Preparer with its associated probability learned over the latest completed window. As an example, if parameters IM WS and IM WA are set to 10 and 5 time units, respectively, the window will cover periods P 1 = [0, 10), P 2 = [5, 15), P 3 = [10,20), and so on. Messages observed in period [10,15) would be matched with the probabilities learned during period P 1 , messages observed in period [15,20) would be matched with the probabilities learned during period P 2 , and so on.…”