Secure and Private Smart Grid: The SPEAR Architecture

Radoglou-Grammatikis, Panagiotis; Sarigiannidis, Panagiotis; Iturbe, Eider; Rios, Erkuden; Sarigiannidis, Antonios; Nikolis, Odysseas; Ioannidis, Dimosthenis; Machamint, Vasileios; Tzifas, Michalis; Giannakoulias, Alkiviadis; Angelopoulos, Michail; Παπαδόπουλος, Αναστάσιος; Ramos, F.

doi:10.1109/netsoft48620.2020.9165420

Cited by 12 publications

(13 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…MENSA was evaluated and validated in four real SG evaluation environments coming from the SPEAR project [53], namely (a) SG lab, (b) distribution substation, (c) hydropower plant and (d) power plant. Table III summarises them, showing what communication protocols are supported for each case.…”

Section: A Evaluation Environmentsmentioning

confidence: 99%

A Unified Deep Learning Anomaly Detection and Classification Approach for Smart Grid Environments

Siniosoglou

Radoglou-Grammatikis

Efstathopoulos³

et al. 2021

IEEE Trans. Netw. Serv. Manage.

Self Cite

102

View full text Add to dashboard Cite

The interconnected and heterogeneous nature of the next-generation Electrical Grid (EG), widely known as Smart Grid (SG), bring severe cybersecurity and privacy risks that can also raise domino effects against other Critical Infrastructures (CIs). In this paper, we present an Intrusion Detection System (IDS) specially designed for the SG environments that use Modbus/Transmission Control Protocol (TCP) and Distributed Network Protocol 3 (DNP3) protocols. The proposed IDS called MENSA (anoMaly dEtection aNd claSsificAtion) adopts a novel Autoencoder-Generative Adversarial Network (GAN) architecture for (a) detecting operational anomalies and (b) classifying Modbus/TCP and DNP3 cyberattacks. In particular, MENSA combines the aforementioned Deep Neural Networks (DNNs) in a common architecture, taking into account the adversarial loss and the reconstruction difference. The proposed IDS is validated in four real SG evaluation environments, namely (a) SG lab, (b) substation, (c) hydropower plant and (d) power plant, solving successfully an outlier detection (i.e., anomaly detection) problem as well as a challenging multiclass classification problem consisting of 14 classes (13 Modbus/TCP cyberattacks and normal instances). Furthermore, MENSA can discriminate five cyberattacks against DNP3. The evaluation results demonstrate the efficiency of MENSA compared to other Machine Learning (ML) and Deep Learning (DL) methods in terms of Accuracy, False Positive Rate (FPR), True Positive Rate (TPR) and the F1 score.

show abstract

Section: A Evaluation Environmentsmentioning

confidence: 99%

A Unified Deep Learning Anomaly Detection and Classification Approach for Smart Grid Environments

Siniosoglou

Radoglou-Grammatikis

Efstathopoulos³

et al. 2021

IEEE Trans. Netw. Serv. Manage.

Self Cite

102

View full text Add to dashboard Cite

show abstract

“…The SPEAR SIEM architecture relies on the ARCADE framework [14] and consists of three layers as illustrated in Fig. 1.…”

Section: Spear Siem Architecturementioning

confidence: 99%

“…In particular, the Streaming Bus relies on Apache Kafka and transmits (a) specific packet payload information, (b) network flow statistics (c) operational data and (e) honeypot data. The operational data is retrieved directly by DAPS from the corresponding SG use case, while the honeypot data is given by the Honeypot Manager, which is an external component analysed in [14]. The SPEAR honeypots and how the honeypot data is introduced into DAPS is out of the scope of this paper.…”

Section: Spear Siem Basismentioning

confidence: 99%

“…The SPEAR honeypots and how the honeypot data is introduced into DAPS is out of the scope of this paper. More details about this content are provided by [36,37] and [14], respectively. Next, DCP is responsible for importing the data published in the Streaming Bus and storing them in the Storage Infrastructure.…”

Section: Spear Siem Basismentioning

confidence: 99%

“…Finally, section 5 concludes this paper. It is noteworthy that SPEAR SIEM was implemented under the H2020 SPEAR project [14].…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

SPEAR SIEM: A Security Information and Event Management system for the Smart Grid

et al. 2021

Self Cite

View full text Add to dashboard Cite

The technological leap of smart technologies has brought the conventional electrical grid in a new digital era called Smart Grid (SG), providing multiple benefits, such as two-way communication, pervasive control and self-healing. However, this new reality generates significant cybersecurity risks due to the heterogeneous and insecure nature of SG. In particular, SG relies on legacy communication protocols that have not been implemented having cybersecurity in mind. Moreover, the advent of the Internet of Things (IoT) creates severe cybersecurity challenges. The Security Information and Event Management (SIEM) systems constitute an emerging technology in the cybersecurity area, having the capability to detect, normalise and correlate a vast amount of security events. They can orchestrate the entire security of a smart ecosystem, such as SG. Nevertheless, the current SIEM systems do not take into account the unique SG peculiarities and characteristics like the legacy communication protocols. In this paper, we present the Secure and PrivatE smArt gRid (SPEAR) SIEM, which focuses on SG. The main contribution of our work is the design and implementation of a SIEM system capable of detecting, normalising and correlating cyberattacks and anomalies against a plethora of SG application-layer protocols. It is noteworthy that the detection performance of the SPEAR SIEM is demonstrated with real data originating from four real SG use case (a) hydropower plant, (b) substation, (c) power plant and (d) smart home.

show abstract

Cyber Attack Detection and Trust Management Toolkit for Defence-Related Microgrids

Medentzidis

Kotsiopoulos

Vasileios

et al. 2021

Artificial Intelligence Applications and Innovations. AIAI 2021 IFIP WG 12.5 International Workshops

View full text Add to dashboard Cite

The rise of microgrids in defence applications, as a greener, more economical and efficient source of energy and the consequential softwarization of networks, has led to the emerge of various cyber-threats. The danger of cyber-attacks in defence microgrid facilities cannot be neglected nor undermined, due to the severe consequences that they can cause. To this end, this paper presents a cyberattack detection and cyber attack severity calculation toolkit, with the aim to provide an end-to-end solution to the cyberattack detection in defense IoT/microgrid systems. Concretely, in this paper are presented and evaluated the SPEAR Visual Analytics AI Engine and the SPEAR Grid Trusted Module (GTM) of the SPEAR H2020 project. The aim of the Visual Analytics AI Engine is to detect malicious action that intend to harm the microgrid and to assist the security engineer of an infrastructure to easily detect abnormalities and submit security events accordingly, while the GTM is responsible to calculate the severity of each security event and to assigns trust values to the affected assets of the system. The accurate detection of cyber-attacks and the efficient reputation management, are assessed with data from a real smart home infrastructure with an installed nanogrid, after applying a 3-stage attack against the MODBUS/TCP protocol used by some of the core nanogrid devices.

show abstract

Secure and Private Smart Grid: The SPEAR Architecture

Cited by 12 publications

References 19 publications

A Unified Deep Learning Anomaly Detection and Classification Approach for Smart Grid Environments

A Unified Deep Learning Anomaly Detection and Classification Approach for Smart Grid Environments

SPEAR SIEM: A Security Information and Event Management system for the Smart Grid

Cyber Attack Detection and Trust Management Toolkit for Defence-Related Microgrids

Contact Info

Product

Resources

About