Integrated Anomaly Detection for Cyber Security of the Substations

Hong, Junho; Liu, Chen‐Ching; Manimaran, G.

doi:10.1109/tsg.2013.2294473

Cited by 179 publications

(34 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A number of GOOSE poisoning attacks are evaluated experimentally on a test bed and demonstrated to be successful. In [3], Hong et al integrate advantages of feature detection and behavior detection, proposes an integrated anomaly detection system based on host and network. Host based anomaly detection analyzes the log information to detect attacks (such as repeated user error passwords, illegal copying of files, etc.).…”

Section: Related Workmentioning

confidence: 99%

An Efficient Behavior-based Intrusion Detection System Using OC-ELM for Intelligent Substation in Smart Grid

Fu¹,

Tian²,

Yin³

et al. 2018

dtcse

View full text Add to dashboard Cite

Abstract. Generic Object Oriented Substation Events (GOOSE), as an essential component of IEC 61850 communication standard, plays an important role in intelligent substation. Any abnormal change of GOOSE field values could cause substation automatic system failures, incorrect switching, or physical damages in the field devices, which will result in probably catastrophic losses. To mitigate the risks caused by vulnerabilities of GOOSE protocol, a behavior-based intrusion detection system is proposed. Different from the existing proposed approaches, considering there is no attack traffic in intelligent substation network so far, one class classifier is used to model the normal behaviors. Compared to the existing approaches, it can usually detect much more complex attacks. To specify the proposed system, when giving a GOOSE message, we first convert it into a feature vector with a specific approach. Considering only normal GOOSE messages are given, One Class classifier with Extreme Learning Machine (OC-ELM) is used to model the information embedded in the normal training set. Extensive experiments demonstrate the efficiency and effectiveness of the proposed intrusion detection system.

show abstract

Section: Related Workmentioning

confidence: 99%

An Efficient Behavior-based Intrusion Detection System Using OC-ELM for Intelligent Substation in Smart Grid

Fu¹,

Tian²,

Yin³

et al. 2018

dtcse

View full text Add to dashboard Cite

show abstract

“…-GOOSE and SV Modification Attack: In [20], an attack is proposed. In this attack, the GOOSE control message packet is captured and then modified with a message that will allow the attacker to gain control and operate circuit breakers in a substation.…”

Section: Attacks On Goose and Sample Values (Sv)mentioning

confidence: 99%

MACsec Layer 2 Security in HSR Rings in Substation Automation Systems

et al. 2017

View full text Add to dashboard Cite

Abstract:The smart-grid concept takes the communications from the enclosed and protected environment of a substation to the wider city or nationwide area. In this environment, cyber security takes a key role in order to secure the communications. The challenge is to be able to secure the grid without impacting the latency while, at the same time, maintaining compatibility with older devices and non secure services. At the lower level, added security must not interfere with the redundancy and the latency required for the real-time substation automation communications. This paper studies how to integrate IEEE MAC Security standard (MACsec) in the substation environment, especially when used in substation system communications that have stringent response time requirements and zero recovery time as defined in IEC 62439-3.

show abstract

“…However, a hybrid IDS has a higher performance in a CPS. For this purpose, an integrated ADS for substation cyber security is proposed [45]. The host-based anomaly detection inspects temporal anomalies in the substation facilities.…”

Section: Ids Protection Range Typementioning

confidence: 99%

“…The integrated ADS proposed in [45] is applied to and validated by the same scenario. For the cyber attack, it is assumed that attackers have full knowledge to access the communication systems in multiple substations.…”

Section: Test Casementioning

confidence: 99%

Cyber-Physical System Security of a Power Grid: State-of-the-Art

2016

Self Cite

View full text Add to dashboard Cite

Abstract:As part of the smart grid development, more and more technologies are developed and deployed on the power grid to enhance the system reliability. A primary purpose of the smart grid is to significantly increase the capability of computer-based remote control and automation. As a result, the level of connectivity has become much higher, and cyber security also becomes a potential threat to the cyber-physical systems (CPSs). In this paper, a survey of the state-of-the-art is conducted on the cyber security of the power grid concerning issues of: (1) the structure of CPSs in a smart grid; (2) cyber vulnerability assessment; (3) cyber protection systems; and (4) testbeds of a CPS. At Washington State University (WSU), the Smart City Testbed (SCT) has been developed to provide a platform to test, analyze and validate defense mechanisms against potential cyber intrusions. A test case is provided in this paper to demonstrate how a testbed helps the study of cyber security and the anomaly detection system (ADS) for substations.

show abstract

Integrated Anomaly Detection for Cyber Security of the Substations

Cited by 179 publications

References 22 publications

An Efficient Behavior-based Intrusion Detection System Using OC-ELM for Intelligent Substation in Smart Grid

An Efficient Behavior-based Intrusion Detection System Using OC-ELM for Intelligent Substation in Smart Grid

MACsec Layer 2 Security in HSR Rings in Substation Automation Systems

Cyber-Physical System Security of a Power Grid: State-of-the-Art

Contact Info

Product

Resources

About