METIS: A Two-Tier Intrusion Detection System for Advanced Metering Infrastructures

Gulisano, Vincenzo; Almgren, Magnus; Papatriantafilou, Marina

doi:10.1007/978-3-319-23802-9_7

Cited by 9 publications

(7 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It should be noted that these options are not mutually exclusive. That is, a security application could run both at the meters as well as at the concentrators, as also discussed in [22]. Table 3 is inspired from [19] and provides a good comparison of all entities in the smart grid systems, especially from the data streaming point of view.…”

Section: What Deployment Options Exist For the Data Analysis?mentioning

confidence: 99%

Intrusion Detection in Industrial Networks via Data Streaming

et al. 2020

Self Cite

View full text Add to dashboard Cite

Given the increasing threat surface of industrial networks due to distributed, Internet-of-Things (IoT) based system architectures, detecting intrusions in Industrial IoT (IIoT) systems is all the more important, due to the safety implications of potential threats. The continuously generated data in such systems form both a challenge but also a possibility: data volumes/rates are high and require processing and communication capacity but they contain information useful for system operation and for detection of unwanted situations. In this chapter we explain that stream processing (a.k.a. data streaming) is an emerging useful approach both for general applications and for intrusion detection in particular, especially since it can enable data analysis to be carried out in the continuum of edge-fog-cloud distributed architectures of industrial networks, thus reducing communication latency and gradually filtering and aggregating data volumes. We argue that usefulness stems also due to facilitating provisioning of agile responses, i.e. due to potentially smaller latency for intrusion detection and hence also improved possibilities for intrusion mitigation. In the chapter we outline architectural features of IIoT networks, potential threats and examples of state-of-the art intrusion detection methodologies. Moreover, we give an overview of how leveraging distributed and parallel execution of streaming applications in industrial setups can influence the possibilities of protecting these systems. In these contexts, we give examples using electricity networks (a.k.a. Smart Grid systems). We conclude that future industrial networks, especially their Intrusion Detection Systems (IDSs), should take advantage of data streaming concept by decoupling semantics from the deployment.

show abstract

Section: What Deployment Options Exist For the Data Analysis?mentioning

confidence: 99%

Intrusion Detection in Industrial Networks via Data Streaming

et al. 2020

Self Cite

View full text Add to dashboard Cite

show abstract

“…Stream processing in the context of AMIs has been explored since 2010. Several different applications have been found for SPEs in this area, including Intrusion Detection Systems (IDSs) [9], real-time pricing [10] and adaptive measurement rates [11]. Data validation with a simplified system model was investigated in [12].…”

Section: B Related Workmentioning

confidence: 99%

eChIDNA: Continuous data validation in advanced metering infrastructures

Rooij

Swetzén

Gulisano

et al. 2018

2018 IEEE International Energy Conference (ENERGYCON)

Self Cite

View full text Add to dashboard Cite

New laws and regulations increase the demands for a more data-intense metering infrastructure towards more adaptive electricity networks (aka smart grids). The automatic measuring, often involving wireless communication, introduces errors both in software and during data transmission. These demands, as well as the large data volumes that need to be validated, present new challenges to utilities. First, measurement errors cannot be allowed to propagate to the data stored by utilities. Second, manual fixing of errors after storing is not a feasible option with increasing data volumes and decreasing lead times for new services and analysis. Third, validation is not only to be applied to current readings but also to past readings when new types of errors are discovered. This paper addresses these issues by proposing a hybrid system, eChIDNA, utilizing both the store-then-process and the data streaming processing paradigms, enabling for high throughput, low latency distributed and parallel analysis. Validation rules are built upon this paradigm and then implemented on the state of the art Apache Storm Stream Processing Engine to assess performance. Furthermore, patterns of common errors are matched, triggering alerts as a first step towards automatic correction of errors. The system is evaluated with production data from hundreds of thousands of smart meters. The results show a performance in the thousands messages per second realm, showing that stream processing can be used to validate large volumes of meter data online with low processing latency, identifying common errors as they appear. The results from the pattern matching are crossvalidated with system experts and show that pattern matching is a viable way to minimize time required from human operators.

show abstract

“…use in planning operations. In [6,10] the authors study the problem of detecting potential intrusions in AMI, since these are highly motivated.…”

Section: Related Workmentioning

confidence: 99%

LoCoVolt

Rooij

Gulisano

Papatriantafilou

2018

Proceedings of the 12th ACM International Conference on Distributed and Event-Based Systems

Self Cite

View full text Add to dashboard Cite

Smart Grids and Advanced Metering Infrastructures are rapidly replacing traditional energy grids. The cumulative computational power of their IT devices, which can be leveraged to continuously monitor the state of the grid, is nonetheless vastly underused. This paper provides evidence of the potential of streaming analysis run at smart grid devices. We propose a structural component, which we name LoCoVolt (Local Comparison of Voltages), that is able to detect in a distributed fashion malfunctioning smart meters, which report erroneous information about the power quality. This is achieved by comparing the voltage readings of meters that, because of their proximity in the network, are expected to report readings following similar trends. Having this information can allow utilities to react promptly and thus increase timeliness, quality and safety of their services to society and, implicitly, their business value. As we show, based on our implementation on Apache Flink and the evaluation conducted with resource-constrained hardware (i.e., with capacity similar to that of hardware in smart grids) and data from a real-world network, the streaming paradigm can deliver efficient and effective monitoring tools and thus achieve the desired goals with almost no additional computational cost.

show abstract

METIS: A Two-Tier Intrusion Detection System for Advanced Metering Infrastructures

Cited by 9 publications

References 21 publications

Intrusion Detection in Industrial Networks via Data Streaming

Intrusion Detection in Industrial Networks via Data Streaming

eChIDNA: Continuous data validation in advanced metering infrastructures

LoCoVolt

Contact Info

Product

Resources

About