Hardware-assisted detection of firmware attacks in inverter-based cyberphysical microgrids

Kuruvila, Abraham Peedikayil; Zografopoulos, Ioannis; Basu, Kanad; Konstantinou, Charalambos

doi:10.1016/j.ijepes.2021.107150

Cited by 44 publications

(11 citation statements)

References 36 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…While many papers focus on network attacks, Ref. [ 18 ] shows firmware modification attacks to solar inverters, evidencing the relative impact on a simulated microgrid architecture, and also proposing a ML-based algorithm to detect such types of malicious actions.…”

Section: State Of the Artmentioning

confidence: 99%

Detecting Cyberattacks on Electrical Storage Systems through Neural Network Based Anomaly Detection Algorithm

Gaggero

Caviglia

Armellin

et al. 2022

Sensors

View full text Add to dashboard Cite

Distributed Energy Resources (DERs) are growing in importance Power Systems. Battery Electrical Storage Systems (BESS) represent fundamental tools in order to balance the unpredictable power production of some Renewable Energy Sources (RES). Nevertheless, BESS are usually remotely controlled by SCADA systems, so they are prone to cyberattacks. This paper analyzes the vulnerabilities of BESS and proposes an anomaly detection algorithm that, by observing the physical behavior of the system, aims to promptly detect dangerous working conditions by exploiting the capabilities of a particular neural network architecture called the autoencoder. The results show the performance of the proposed approach with respect to the traditional One Class Support Vector Machine algorithm.

show abstract

Section: State Of the Artmentioning

confidence: 99%

Detecting Cyberattacks on Electrical Storage Systems through Neural Network Based Anomaly Detection Algorithm

Gaggero

Caviglia

Armellin

et al. 2022

Sensors

View full text Add to dashboard Cite

show abstract

“…[36]. Additionally, other attacks assume that the adversary is capable of compromising peripheral controllers and deploy custom firmware [37] (e.g., change voltage measurement values in human-machine interfaces (HMIs) [32]). As a result, attackers can remotely manipulate and jeopardize various physical assets (e.g., distribution level devices, DERs, substation equipment, etc.)…”

Section: A Adversary Modelmentioning

confidence: 99%

“…This energy buffer interface can help avoid unintentional islandings, which could be triggered due to the conflicting anti-islanding detection and low/high voltage ride-through functions that inverters support. The microarchitectural hardware components of inverter controllers have also been utilized for the detection of malicious events within the DER asset's process control loop [37]. In [48], the inherent physical properties of DER-integrated grid systems are used to identify potential actuator or sensor modifications which could lead to abnormal system operation.…”

Section: B Der Device Levelmentioning

confidence: 99%

Distributed Energy Resources Cybersecurity Outlook: Vulnerabilities, Attacks, Impacts, and Mitigations

Zografopoulos¹,

Konstantinou²,

Hatziargyriou³

2022

Preprint

Self Cite

View full text Add to dashboard Cite

The digitalization and decentralization of the electric power grid are key thrusts towards an economically and environmentally sustainable future. Towards this goal, distributed energy resources (DER), including rooftop solar panels, battery storage, electric vehicles, etc., are becoming ubiquitous in power systems, effectively replacing fossil-fuel based generation. Power utilities benefit from DERs as they minimize transmission costs, provide voltage support through ancillary services, and reduce operational risks via their autonomous operation. Similarly, DERs grant users and aggregators control over the power they produce and consume. Apart from their sustainability and operational objectives, the cybersecurity of DER-supported power systems is of cardinal importance. DERs are interconnected, interoperable, and support remotely controllable features, thus, their cybersecurity should be thoroughly considered. DER communication dependencies and the diversity of DER architectures (e.g., hardware/software components of embedded devices, inverters, controllable loads, etc.) widen the threat surface and aggravate the cybersecurity posture of power systems. In this work, we focus on security oversights that reside in the cyber and physical layers of DERs and can jeopardize grid operations. We analyze adversarial capabilities and objectives when manipulating DER assets, and then present how protocol and device -level vulnerabilities can materialize into cyberattacks impacting power system operations. Finally, we provide mitigation strategies to thwart adversaries and directions for future DER cybersecurity.

show abstract

“…The changes can range from minor alterations, like voltage injections with minor effects on system performance, to noise additions in sensor measurements which can generate erroneous control inputs to grid devices affecting the power generation, voltage stability, and introducing harmonic frequencies [10]. Although such perturbations might be small in magnitude to remain undetected, their impact can increase over prolonged periods of time and threaten nominal system operation [11].…”

Section: Introductionmentioning

confidence: 99%

Behind Closed Doors: Process-Level Rootkit Attacks in Cyber-Physical Microgrid Systems

Rath¹,

Zografopoulos²,

Vergara³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

Embedded controllers, sensors, actuators, advanced metering infrastructure, etc. are cornerstone components of cyber-physical energy systems such as microgrids (MGs). Harnessing their monitoring and control functionalities, sophisticated schemes enhancing MG stability can be deployed. However, the deployment of 'smart' assets increases the threat surface. Power systems possess mechanisms capable of detecting abnormal operations. Furthermore, the lack of sophistication in attack strategies can render them detectable since they blindly violate power system semantics. On the other hand, the recent increase of process-aware rootkits that can attain persistence and compromise operations in undetectable ways requires special attention. In this work, we investigate the steps followed by stealthy rootkits at the process level of control systems pre-and post-compromise. We investigate the rootkits' precompromise stage involving the deployment to multiple system locations and aggregation of system-specific information to build a neural network-based virtual data-driven model (VDDM) of the system. Then, during the weaponization phase, we demonstrate how the VDDM measurement predictions are paramount, first to orchestrate crippling attacks from multiple system standpoints, maximizing the impact, and second, impede detection blinding system operator situational awareness.

show abstract

Hardware-assisted detection of firmware attacks in inverter-based cyberphysical microgrids

Cited by 44 publications

References 36 publications

Detecting Cyberattacks on Electrical Storage Systems through Neural Network Based Anomaly Detection Algorithm

Detecting Cyberattacks on Electrical Storage Systems through Neural Network Based Anomaly Detection Algorithm

Distributed Energy Resources Cybersecurity Outlook: Vulnerabilities, Attacks, Impacts, and Mitigations

Behind Closed Doors: Process-Level Rootkit Attacks in Cyber-Physical Microgrid Systems

Contact Info

Product

Resources

About