Game Theoretic Honeypot Deployment in Smart Grid

Abstract

The smart grid provides advanced functionalities, including real-time monitoring, dynamic energy management, advanced pricing mechanisms, and self-healing, by enabling the two-way flow of power and data, as well as the use of Internet of Things (IoT) technologies and devices. However, converting the traditional power grids to smart grids poses severe security challenges and makes their components and services prone to cyber attacks. To this end, advanced techniques are required to mitigate the impact of the potential attacks. In this paper, we investigate the use of honeypots, which are considered to mimic the common services of the smart grid and are able to detect unauthorized accesses, collect evidence, and help hide the real devices. More specifically, the interaction of an attacker and a defender is considered, who both optimize the number of attacks and the defending system configuration, i.e., the number of real devices and honeypots, respectively, with the aim to maximize their individual payoffs. To solve this problem, game theoretic tools are used, considering an one-shot game and a repeated game with uncertainty about the payoff of the attacker, where the Nash Equilibrium (NE) and the Bayesian NE are derived, respectively. Finally, simulation results are provided, which illustrate the effectiveness of the proposed framework.

A Comprehensive Review on Smart Grids: Challenges and Opportunities

“…Note that 17% can find both in NANs and WSNs, respectively, pointing out a great opportunity to develop smart grids with softwaredefined topologies. Internet of Things [19,23,24,27,28,30,31,36,37,58,64,66,73,74,79,105,107] Machine learning [20,29,32,51,55,56,60,62,69,78,80,81,85,98,102,106] Data mining [47,107] Machine learning and neural training [21,54,69,81,96] Short term memory network [41,61] Power Line Communication Technology [53,63,90] Power electronics [35,50,99,101,<...>…”

“…Nevertheless, changing the traditional grids into SGs makes their components and services prone to cyber-attacks. Diamantoulakis et al [105] investigated the optimization of attacks and the defending system by the interaction of an attacker and a defender i.e., the number of real devices and honeypots, respectively, focused to maximize their individual payoffs. The authors derived both the Nash Equilibrium (NE) and the Bayesian NE for the first and the second game, respectively, as the corresponding conditions with uncertainty about the payoff of the attacker, as well as offering an alternative structure for situations without equilibrium to optimize the worst-case scenario.…”

SPEAR SIEM: A Security Information and Event Management system for the Smart Grid

“…The SPEAR honeypots and how the honeypot data is introduced into DAPS is out of the scope of this paper. More details about this content are provided by [36,37] and [14], respectively. Next, DCP is responsible for importing the data published in the Streaming Bus and storing them in the Storage Infrastructure.…”

“…As in the previous cases, the evaluation of the particular models is detailed in section 4. [55] and [36,37]. In particular, the honeypots' logs are collected by the Honeypot Manager that forwards them to the Honeypots-Based Detection Model.…”

SDN-Based Resilient Smart Grid: The SDN-microSENSE Architecture

“…According to [36], a honeypot is "an information system whose value lies in unauthorised or illicit use of the resource". In other words, honeypots are commonly used as an extra security layer in order to act as a decoy, which lures the cyberattackers and captures useful information about their identity and activities [37]. SDN-microSENSE provides a variety of EPES/SG honeypots that implement realistic emulations for three EPES/SG communication protocols: (a) IEC-61850, (b) IEC-60870-5-104, and (c) Modbus/TCP.…”