Integrated anomaly detection for cyber security of the substations

IEEE Transactions on Smart Grid

Volumn 5, Issue 4, 2014, Pages 1643-1653

  Hong, Junho ^a   Liu, Chen Ching ^a,b   Govindarasu, Manimaran ^c  

^a WASHINGTON STATE UNIVERSITY   (United States)

^b UNIVERSITY COLLEGE DUBLIN   (Ireland)

^c IOWA STATE UNIVERSITY   (United States)

Author keywords

Anomaly detection; cyber security of substations; GOOSE anomaly detection; SMV anomaly detection and intrusion detection

Indexed keywords

INTRUSION DETECTION; OUTAGES;

ANOMALY DETECTION; ANOMALY DETECTION SYSTEMS; CYBER SECURITY; GENERIC OBJECT ORIENTED SUB-STATION EVENTS; INTELLIGENT ELECTRONIC DEVICE; INTRUSION DETECTION METHOD; SAMPLED MEASURED VALUE (SMV); SUBSTATION AUTOMATION;

DISTRIBUTED COMPUTER SYSTEMS;

EID: 84903266307     PISSN: 19493053     EISSN: None     Source Type: Journal    
DOI: 10.1109/TSG.2013.2294473     Document Type: Article

References (37)

1. A. R. Metke and R. L. Ekl, "Security technology for smart grid net works," IEEE Trans. Smart Grid, vol. 1, no. 1, pp. 99-107, Jun. 2010.
2. F. Li, W. Qiao, H. Sun, H. Wan, J. Wang, Y. Xia, Z. Xu, and P. Zhang, "Smart transmission grid: Vision and framework," IEEE Trans. Smart Grid, vol. 1, no. 2, pp. 168-177, Sep. 2010.
3. M. Kezunovic, "Smart fault location for smart grids," IEEE Trans. Smart Grid, vol. 2, no. 1, pp. 11-22, Mar. 2011.
4. NIST Framework and Roadmap for Smart Grid Interoperability Standards, NIST 1108R2, National Institute for Standards and Technology, Feb. 2012 [Online]. Available: http://www.nist.gov/smartgrid/upload/NIST-Framework- Release-2-0-corr.pdf
5. J. D. McDonald, Electric Power Substations Engineering. Boca Raton, FL, USA: CRC, 2012.
6. J.-W. Wang and L.-L. Rong, "Cascade-based attack vulnerability on the US power grid," Safety Sci., vol. 47, no. 10, pp. 1332-1336, Dec. 2009.
7. S. Sridhar, A. Hahn, and M. Govindarasu, "Cyber-physical system security for the electric power grid," Proc. IEEE, vol. 100, no. 1, pp. 210-224, Jan. 2012.
8. V. Chandola, B. Arindam, and K. Vipin, "Anomaly detection: A survey," ACM Comput. Surveys (CSUR), vol. 41, no. 3, pp. 15-58, Jul. 2009.
9. J. P. Anderson, Computer Security Threat Monitoring and Surveillance. Washing, PA, USA: James P. Anderson Co., 1980.
10. D. E. Denning, "An intrusion detection model," in Proc. 7th IEEE Symp. Security Privacy, May 1986, pp. 119-131.
11. J. Hall, M. Barbeau, and E. Kranakis, "Anomaly-based intrusion detection using mobility profiles of public transportation users," in Proc. IEEE Int. Conf. Wireless Mobile Comput. Netw. Commun. (WiMob'2005), Aug. 2005, vol. 2, pp. 17-24. (Pubitemid 44172510)
12. B. Sun, F. Yu, K. Wu, Y. Xiao, and V. C. M. Leung, "Enhancing security using mobility-based anomaly detection in cellular mobile networks," IEEE Trans. Veh. Technol., vol. 55, no. 4, pp. 1385-1396, Jul. 2006. (Pubitemid 44111432)
13. N. Ye, S. M. Emran, Q. Chen, and S. Vilbert, "Multivariate statistical analysis of audit trails for host-based intrusion detection," IEEE Trans. Comput., vol. 51, no. 7, pp. 810-820, Jul. 2002. (Pubitemid 34835448)
14. J. Hu, X. Yu, D. Qiu, and H.-H. Chen, "A simple and efficient hidden Markov model scheme for host-based anomaly intrusion detection," IEEE Netw., vol. 23, no. 1, pp. 42-47, Jan. 2009.
15. M. J. Shevenell and R. F. Erbacher, "Design and implementation of an open network and host-based intrusion detection testbed with an emphasis on accuracy and repeatability," in Proc. 9th Int. Conf. Inf. Technol.: New Generations (ITNG), Apr. 2012, pp. 409-416.
16. S. Bijan and A. M. Kazemitabar, "HIDMN: A host and network-based intrusion detection for mobile networks," in Proc. Int. Conf. Comput. Electr. Eng. (ICCEE), Dec. 2008, pp. 204-208.
17. U.-K. Premaratne, J. Samarabandu, T.-S. Sidhu, R. Beresh, and J.-C. Tan, "An intrusion detection system for IEC 61850 automated substations," IEEE Trans. Power Del., vol. 25, no. 4, pp. 2376-2383, Oct. 2010.
18. C.-W. Ten, C.-C. Liu, and G. Manimaran, "Vulnerability assessment of cybersecurity for SCADA systems," IEEE Trans. Power Syst., vol. 23, no. 4, pp. 1836-1846, Nov. 2008.
19. C.-W. Ten, J. Hong, and C.-C. Liu, "Anomaly detection for cyberse-curity of the substations," IEEE Trans. Smart Grid, vol. 2, no. 4, pp. 865-873, Dec. 2011.
20. S.-M. Amin and A. M. Giacomoni, "Smart grid-safe, secure, self-healing: Challenges and opportunities in power system security, resiliency, and privacy," IEEE Power Energy Mag., pp. 33-40, Jan. 2012.
21. G. Dan, H. Sandberg, M. Ekstedt, and G. Bjorkman, "Challenges in power system information security," IEEE Security Privacy, vol. 10, no. 4, pp. 62-70, Jul. 2012.
22. D. Kushner, "The real story of Stuxnet," IEEE Spectrum, vol. 50, no. 3, pp. 48-53, Mar. 2013.
23. M. Govindarasu, A. Hann, and P. Sauer, "Cyber-physical systems security for smart grid," Future Grid Initiative White Paper, PSERC, Feb. 2012 [Online]. Available: http://www.pserc.wisc. edu/documents/publications/ papers/fgwhitepapers/Govindarasu-Fu-ture-Grid-White-Paper-CPS-May-2012.pdf
24. Government Accountability Office (GAO), "Electricity grid modernization: Progress being made on cyber security guidelines, but key challenges remain to be addressed," GAO-11-117, Jan. 2011 [Online]. Available: http://www.gao.gov/new.items/d11117.pdf
25. Guidelines for Smart Grid Cyber Security, NISTIR 7628, National Institute for Standards and Technology, Aug. 2010 [Online]. Available: http://csrc.nist.gov/publications/nistir/ir7628/nistir-7628-vol2.pdf
26. Standard: Part 1: Communication Network and System Security-Introduction to Security Issues, IEC TS 62351-1, Power Systems Management and Associated Information Exchange-Data and Communications Security, May 2007, 1st Ed.
27. P. Judge and M. Ammar, "Security issues and solutions in multicast content distribution: A survey," IEEE Netw., vol. 17, no. 1, pp. 30-36., Jan. 2003.
28. C.-C. Liu, A. Stefanov, J. Hong, and P. Panciatici, "Intruders in the grid," IEEE Power Energy Mag., vol. 10, no. 1, pp. 58-66, Feb. 2012.
29. Standard: Sampled Values over ISO/IEC 8802-3, IEC 61850 9-2, Specific Communication Service Mapping (SCSM), Apr. 2004, 1st Ed.
30. Standard: Mapping to MMS (ISO/IEC9506-1 and ISO/IEC 9506-2), IEC 61850 8-1, Specific Communication Service Mapping (SCSM), May 2004, 1st edition.
31. Standard: Communication Requirements for Functions and Device Models, IEC 61850-5, Communication Networks and Systems in Substations, Jul. 2003, 1st Edition.
32. U.S. Department of Energy, Office of Electricity Delivery and Energy Reliability, National SCADA Test Bed Program Jan. 2008 [Online]. Available: http://energy.gov/sites/prod/files/oeprod/Documentsand-Media/ DOE-OE-NSTB-Multi-Year-Plan.pdf
33. A. Hahn and M. Govindarasu, "Cyber attack exposure evaluation framework for the smart grid," IEEE Trans. Smart Grid, vol. 2, no. 4, pp. 835-843, Jun. 2011.
34. G. Dondossola, F. Garrone, G. Proserpio, and C. Tornelli, "Impact of DER integration on the cyber security of SCADA systems-The medium voltage regulation case study," in Integration of Renewables into the Distribution Grid, CIRED Workshop, May 2012, pp. 1-4.
35. M. Hillenmeyer, Machine Learning. Stanford, CA, USA: Stanford Univ., Jul. 2005 [Online]. Available: http://www.stanford.edu/~mau-reenh/quals/pdf/ml.pdf
36. A. Harvey, "Cybersecurity enhancement in a power substation," M.S. Thesis, School of Electrical, Electronic and Mechanical Engineering, University College Dublin, Dublin, Ireland, 2011.
37. tshark [Online]. Available: http://www.wireshark.org/docs/man-pages/ tshark.html