Specification-based Intrusion Detection for home area networks in smart grids

Jokar, Paria; Nicanfar, Hasen; Leung, Victor C. M.

doi:10.1109/smartgridcomm.2011.6102320

Cited by 74 publications

(48 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In [25], we studied the architecture of HAN and proposed a specification based intrusion detection approach for HAN. This work is an extension of our previous work.…”

Section: Related Workmentioning

confidence: 99%

“…This work is an extension of our previous work. Some changes in current work compare to [25] are: we take a more accurate look at HAN architecture and requirement of IDS for HAN, we optimize the feature space and include some statistical features, we apply a more effective classification scheme and we evaluate the performance of our IDS against some existing attacks.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Smart Grid Cyber Security Challenges: Overview and Classification

Mendel¹

2017

e-mentor

View full text Add to dashboard Cite

In this paper we present a model-based intrusion detection system (IDS) for home area networks (HANs) within the smart grid. Considering that ZigBee is the dominant technology in future HAN, the proposed IDS is designed to target ZigBee standard. Our focus is on the physical and medium access control (MAC) layers of ZigBee technology, which are defined in IEEE 802.15.4 standard. In the proposed IDS, normal behavior of the network is modeled through specifications extracted from the IEEE 802.15.4 standard as well as features of wireless network traffic. Deviations from normal behavior can be a sign of malicious activities. We use Bayesian network as a classifier to distinguish the normal and malicious behavior of the network according to extracted features. We further investigate the physical and MAC layer attacks in IEEE 802.15.4 networks that have been introduced in literature. In order to evaluate the performance of the proposed method we simulate a HAN network as well as some attack scenarios, in NS-2 simulation environment. We evaluate the performance of the proposed IDS against these attacks. Analysis and simulation results demonstrate that the proposed IDS provides good detection performance against known attacks, and since this is an IDS based on anomalous event detection, we expect the same for unknown attacks. KeywordsHAN, IDS, smart grid I TRODUCTIOSmart grid is a vision to modernize the electricity transmission and distribution systems. Smart grid incorporates computer intelligence into the power system, and provides two way energy flow and data communication. Unlocking the tremendous potential of the smart grid such as resilience, high power quality, and consumer participation, strongly depends on the security of this system. Integration of a data layer to the power grid can expose the system to many cyber security threats. Smart grid is an infrastructure that many other utilities rely on; without strong security measures, not only the smart grid will inherit the vulnerabilities of the legacy power system, but also new vulnerabilities will be added due to the proliferation of new technologies.In the 2009 White House Cyberspace Policy Review, federal government was asked to "ensure that security standards are developed and adopted to avoid creating unexpected opportunists to penetrate these systems or conduct large-scale attacks" [1]. The US National Institute of Standards and Technology (NIST) has provided guidelines for developers and policy makers, covering cyber security requirements of the smart grid that should be included from the beginning of the development process [2]. Along with the security mechanisms that should be designed into the smart grid with the goal of reducing the vulnerabilities and mitigating their consequences, such as cryptographic algorithms and secure protocols, appropriate intrusion detection systems (IDSs) are also required. The need for research on intrusion detection for embedded processors has been emphasized in "NIST guidelines for smart grid cyber security", ...

show abstract

“…In [25], we studied the architecture of HAN and proposed a specification based intrusion detection approach for HAN. This work is an extension of our previous work.…”

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Smart Grid Cyber Security Challenges: Overview and Classification

Mendel¹

2017

e-mentor

View full text Add to dashboard Cite

show abstract

“…A HAN-based IDS in smart grid was proposed in [19]. For ZigBee technology, normal behavior in detection library is obtained by extracting some information from the IEEE 802.15.4 standard.…”

Section: B Active Defensementioning

confidence: 99%

Advanced Metering Infrastructure Security Issues and its Solution: A Review

XU¹

2015

IJIRCCE

View full text Add to dashboard Cite

Advanced metering infrastructure (AMI) is the core component in smart grid. Moreover, two-way communication between the user and the power utility is realized through AMI. Composition of AMI is described. AMI security requirements are illustrated. The threats on the smart meters, communications network, and data collector are analyzed, respectively. Passive and active defenses are investigated. For the passive defense, the traditional encryption technology has low key transportation security, while the public key infrastructure (PKI) used in the whole smart grid has high cost and long computation time and current ID-based authentication mechanism does not offer mutual authentication between smart meter and smart device. When intrusion detection system (IDS) is deployed on AMI key nodes, it is possible to meet the cost effectiveness and computational efficiency and to make up for the passive security policy.

show abstract

“…In [17], the requirements and practical needs for monitoring and intrusion detection in AMI is discussed. In [18], a layered combined signature and anomaly-based IDS for HAN was proposed. This IDS was designed for a ZigBee based HAN which works at the physical and medium access control (MAC) layers.…”

mentioning

confidence: 99%

A New Intrusion Prevention System for Protecting Smart Grids from ICMPv6 Vulnerabilities

Chakraborty

Chaki

Cortesi

2014

Annals of Computer Science and Information Systems

View full text Add to dashboard Cite

Abstract-Smart Grid is an integrated power grid with a. reliable, communication network running in parallel towards providing two way communications in the grid. It's trivial to mention that a network like this would connect a huge number of IP-enabled devices. IPv6 that offers 18-bit address space becomes an obvious choice in this context. In a smart grid, functionalities like neighborhood discovery, autonomic address configuration of a node or its router identification may often be invoked whenever newer equipments are introduced for capacity enhancement at some level of hierarchy. In IPv6, these basic functionalities like neighborhood discovery, autonomic address configuration of networking require to use Internet Control Message Protocol version 6 (ICMPv6). Such usage may lead to security breaches in the grid as a result of possible abuses of ICMPv6 protocol. In this paper, some potential newer attacks on Smart Grid have been discussed. Subsequently, intrusion prevention mechanisms for these attacks are proposed to plugin the threats.

show abstract

Specification-based Intrusion Detection for home area networks in smart grids

Cited by 74 publications

References 7 publications

Smart Grid Cyber Security Challenges: Overview and Classification

Smart Grid Cyber Security Challenges: Overview and Classification

Advanced Metering Infrastructure Security Issues and its Solution: A Review

A New Intrusion Prevention System for Protecting Smart Grids from ICMPv6 Vulnerabilities

Contact Info

Product

Resources

About