Preventive Maintenance for Advanced Metering Infrastructure Against Malware Propagation

IEEE Transactions on Smart Grid

Volumn 7, Issue 3, 2016, Pages 1314-1328

  Guo, Yonghe ^a   Ten, Chee Wooi ^a   Hu, Shiyan ^a   Weaver, Wayne W ^a  

^a 815 RL Smith ME EM Building   (United States)

Author keywords

Advanced metering infrastructure (AMI); anomaly detection; malware propagation; preventive maintenance

Indexed keywords

COMPUTER CRIME; MALWARE; PREVENTIVE MAINTENANCE;

ANOMALY DETECTOR; CONTROL VARIABLE; ELECTRONIC METERS; INFORMATION INTEGRITY; INSPECTION STRATEGY; MALWARE PROPAGATION; ON SITE INVESTIGATIONS; OPTIMAL FREQUENCY;

ADVANCED METERING INFRASTRUCTURES;

EID: 84939146888     PISSN: 19493053     EISSN: None     Source Type: Journal    
DOI: 10.1109/TSG.2015.2453342     Document Type: Article

References (54)

1. (Oct. 2011). Advanced Metering Infrastructure National Energy Technology Laboratory. [Online]. Available: http://www.netl.goe.gov/smartgrid/refshelf.html
2. (2008). What the Smart Grid Means to Americans, U.S. Department of Energy. [Online]. Available: http://www.doe.gov/sites/prod/files/oeprod/DocumentsandMedia/ConsumerAdvocates.pdf
3. Y. Yan, Y. Qian, H. Sharif, and D. Tipper, "A survey on smart grid communication infrastructures: Motivations, requirements and challenges," Commun. Surveys Tuts., vol. 15, no. 1, pp. 5-20, Mar. 2013.
4. (Oct. 2013). Smart Grid Investment Grant Program: Progress Report II. Meter and Service Technical Committee Report Ver. 2. U.S. Department of Energy. [Online]. Available: https://smartgrid.gov/sites/default/files/doc/files/SGIG-progress-report-2013.pdf
5. E. Bou-Harb, C. Fachkha, M. Pourzandi, M. Debbabi, and C. Assi, "Communication security for smart grid distribution networks," IEEE Commun. Mag., vol. 51, no. 1, pp. 42-49, Jan. 2013.
6. Y. Zhang, L. Wang, W. Sun, R. C. Green, and M. Alam, "Distributed intrusion detection system in a multi-layer network architecture of smart grids," IEEE Trans. Smart Grid, vol. 2, no. 4, pp. 796-808, Dec. 2011.
7. R. Berthier, W. H. Sanders, and H. Khurana, "Intrusion detection for advanced metering infrastructures: Requirements and architectural directions," in Proc. 1st IEEE Int. Conf. Smart Grid Commun. (SmartGridComm), Gaithersburg, MD, USA, Oct. 2010, pp. 350-355.
8. (2012). Cybersecurity Risk Management Process. [Online]. Available: http://energy.gov/oe/downloads/cybersecurity-risk-management-processrmp-guideline-final-may-2012
9. Federal office for information security. (Oct. 18, 2013). Protection Profile for the Security Module of a Smart Meter Gateway (Security Module PP). SecMod-PP Version 1.02. [Online]. Available: https://www.commoncriteriaportal.org/files/ppfiles/pp0077b-pdf.pdf
10. M. A. Faisal, Z. Aung, J. R. Williams, and A. Sanchez, "Securing advanced metering infrastructure using intrusion detection system with data stream mining," in Proc. Pac. Asia Workshop (PAISI), Kuala Lumpur, Malaysia, May 2012, pp. 96-111.
11. Y. Yan, Y. Qian, H. Sharif, and D. Tipper, "A survey on cyber security for smart grid," Commun. Surveys Tuts., vol. 14, no. 4, pp. 998-1010, Dec. 2012.
12. F. Baker and D. Meyer, Internet Protocols for the Smart Grid, IETF Standard RFC6272, Jun. 2011. [Online]. Available: http://tools.ietf.org/html/rfc6272#section-3.2
13. M. Ward. (Oct. 16, 2011). Smart Meters Can be Hacked to Cut Power Bills, BBC News. [Online]. Available: http://www.bbc.com/news/technology-29643276
14. M. Liebowitz. (Apr. 10, 2012). Smart Meter Hacks Cost Hundreds of Millions Annually, FBI Says, NBC News. [Online]. Available: http://www.nbcnews.com/id/47003851/ns/technology-and-sciencesecurity/t/smart-meter-hacks-cost-hundreds-millions-annually-fbi-says/#.VNri4PmHrwB
15. J. Alderson, Advanced Metering Infrastructure Attack Methodology, InGuardian, Inc., Washington, DC, USA, Jan. 5, 2009. [Online]. Available: http://inguardians.com/pubs/AMI-Attack-Methodology.pdf
16. ZDnet. (Sep. 14, 2010). Stuxnet Attackers Used 4 Windows Zero-Day Exploits. [Online]. Available: http://www.zdnet.com/article/stuxnet-attackers-used-4-windows-zero-day-exploits/
17. Cable News Network. (Sep. 26, 2007). Sources: Staged Cyber Attack Revelas Vulnerability in Power Grid. [Online]. Available: http://www.cnn.com/2007/US/09/26/power.at.risk/
18. L. Pietre-Cambacedes, M. Tritschler, and G. N. Ericsson, "Cybersecurity myths on power control systems: 21 misconceptions and false beliefs," IEEE Trans. Power Del., vol. 26, no. 1, pp. 161-172, Jan. 2011.
19. F. M. Cleveland, "Cybersecurity issues for advanced metering infrasttructure (AMI)," in Proc. IEEE Power Energy Soc. Gen. Meeting Convers. Del. Elect. Energy 21st Cent., Pittsburgh, PA, USA, Jul. 2008, pp. 1-5.
20. C. Liao, C.-W. Ten, and S. Hu, "Strategic FRTU deployment considering cybersecurity in secondary distribution network," IEEE Trans. Smart Grid, vol. 4, no. 3, pp. 1264-1274, Sep. 2013.
21. S. McLaughlin, D. Podkuiko, S. Miadzvezhanka, A. Delozier, and P. McDaniel, "Multi-vendor penetration testing in the advanced metering infrastructure," in Proc. Annu. Comput. Security Appl. Conf., Austin, TX, USA, 2010, pp. 107-116.
22. S. McLaughlin, D. Podkuiko, and P. McDaniel, "Energy theft in the advanced metering infrastructure," in Proc. 4th Int. Workshop Crit. Inf. Infrastruct. Security (CRITIS), Bonn, Germany, 2009, pp. 176-187.
23. P. McDaniel and S. McLaughlin, "Security and privacy challenges in the smart grid," IEEE Security Privacy, vol. 7, no. 3, pp. 75-77, May/Jun. 2009.
24. Y. Guo, C. W. Ten, and P. Jirutitijaroen, "Online data validation for distribution operations against cybertampering," IEEE Trans. Power Syst., vol. 29, no. 2, pp. 550-560, Mar. 2014.
25. A.-H. Mohsenian-Rad and A. Leon-Garcia, "Distributed Internetbased load altering attacks against smart power grids," IEEE Trans. Smart Grid, vol. 2, no. 4, pp. 667-674, Dec. 2011.
26. S. Li, Y. Yilmaz, and X. Wang, "Quickest detection of false data injection attack in wide-area smart grids," IEEE Trans. Smart Grid, to be published.
27. E. Choo, Y. Park, and H. Siyamwala, "Identifying malicious metering data in advanced metering infrastructure," in Proc. IEEE 8th Int. Symp. Service Orient. Syst. Eng., Oxford, MS, USA, Apr. 2014, pp. 490-495.
28. M. LeMay and C. A. Gunter, "Cumulative attestation kernels for embedded systems," IEEE Trans. Smart Grid, vol. 3, no. 2, pp. 744-760, Jun. 2012.
29. Z. Xiao, Y. Xiao, and H.-C. Du, "Exploring malicious meter inspection in neighborhood area smart grids," IEEE Trans. Smart Grid, vol. 4, no. 1, pp. 214-226, Mar. 2013.
30. Y. H. Chang, P. Jirutitijaroen, and C.-W. Ten, "A simulation model of cyber threats for energy metering devices in a secondary distribution network," in Proc. 5th Int. Conf. Crit. Infrastruct., Beijing, China, Sep. 2010, pp. 1-7.
31. Y. Park, D. Nicol, H. Zhu, and C.-W. Lee, "Prevention of malware propagation in AMI," in Proc. IEEE Smart Grid Commun. Symp. Smart Grid Cyber Security Privacy, Vancouver, BC, Canada, Oct. 2013, pp. 474-479.
32. M. A. Rahman, E. Al-Shaer, and P. Bera, "A noninvasive threat analyzer for advanced metering infrastructure in smart grid," IEEE Trans. Smart Grid, vol. 4, no. 1, pp. 273-287, Mar. 2013.
33. S. Amin, G. A. Schwartz, A. Cardenas, and S. S. Sastry, "Gametheoretic models of electricity theft detection in smart utility networks," IEEE Control Syst., vol. 35, no. 1, pp. 66-81, Feb. 2015.
34. Z. Ismail, J. Leneutre, D. Bateman, and L. Chen, "A game theoretical analysis of data confidentiality attacks on smart grid AMI," IEEE J. Sel. Areas Commun., vol. 32, no. 7, pp. 1486-1499, Jul. 2014.
35. D. Niyato and P. Wang, "Cooperative transmission for meter data collection in smart grid," IEEE Commun. Mag., vol. 50, no. 4, pp. 90-97, Apr. 2012.
36. (2015). Smart Grid & Energy Solutions Guide, Texas Instruments. [Online]. Available: http://www.ti.com/lit/sl/slym071o/slym071o.pdf
37. J. Wright. (Oct. 21, 2009). Killerbee: Practical Zigbee Exploitation Framework. [Online]. Available: http://www.willhackforsushi.com/presentations/toorcon11-wright.pdf
38. K. J. Houle, G. M. Weaver, N. Long, and R. Thomas, "Trends in denial of service attack technology," CERT Coordination Center, Pittsburgh, PA, USA, Tech. Rep. 52490, Oct. 2001. [Online]. Available: http://www.cert.org/archive/pdf/DoS-trends.pdf
39. (Dec. 2009). DLMS/COSEM Architecture and Protocols. [Online]. Available: http://dlms.com/documents/Excerpt-GB7.pdf
40. Electricity Metering-Data Exchange For Meter Reading, Tariff And Load Control (Part 61: Object Identification System (OBIS), IEC Standard 62056-61, 2006.
41. Electricity Metering-Data Exchange for Meter Reading, Tariff and Load Control (Part 62: Interface Classes), IEC Standard 62056-62, 2006.
42. C. C. Zou, W. Gong, and D. Towsley, "Worm propagation modeling and analysis under dynamic quarantine defense," in Proc. ACM Workshop Rapid Malcode (WORM), Washington, DC, USA, 2003, pp. 51-60. [Online]. Available: http://doi.acm.org/10.1145/948187.948197
43. Z. Chen, L. Gao, and K. Kwiaty, "Modeling the spread of active worms," in Proc. 22nd Annu. Joint Conf. IEEE Comput. Commun. IEEE Soc. (INFOCOM), vol. 3. San Francisco, CA, USA, Mar. 2003, pp. 1890-1900.
44. S. Khayam and H. Radha, "A topologically-aware worm propagation model for wireless sensor networks," in Proc. 25th IEEE Int. Conf. Distrib. Comput. Syst. Workshops, Columbus, OH, USA, Jun. 2005, pp. 210-216.
45. M. A. Faisal, Z. Aung, J. R. Williams, and A. Sanchez, "Data-streambased intrusion detection system for advanced metering infrastructure in smart grid: A feasibility study," IEEE Syst. J., vol. 9, no. 1, pp. 31-44, Mar. 2015.
46. K. Scarfone and P. Mell, "Guide to intrusion detection and prevention systems (IDPS)," National Institute of Standards and Technology, Gaithersburg, MD, USA, Tech. Rep. NIST SP 800-94, 2007. [Online]. Available: http://csrc.nist.gov/publications/nistpubs/800-94/SP800-94.pdf
47. A. A. Cardenas et al., "A framework for evaluating intrusion detection architectures in advanced metering infrastructures," IEEE Trans. Smart Grid, vol. 5, no. 2, pp. 906-915, Mar. 2014.
48. S. McLaughlin, D. Podkuiko, A. Delozier, S. Miadzvezhanka, and P. McDaniel, "Embedded firmware diversity for smart electric meters," in Proc. 5th USENIX Conf. Hot Topics Security, Berkeley, CA, USA, Aug. 2010, pp. 1-6.
49. J. Larsen. (Nov. 2012). Cybersecurity of Field Equipment of SCADA. TCIPG Seminar. [Online]. Available: https://tcipg.org/sites/default/files/slides/2012-11-02-Larsen.pdf
50. K. Mirkovic, S. Dietrich, D. Dittrich, and P. Reiher, Internet Denial of Service: Attack and Defense Mechanisms, 1st ed. Upper Saddle River, NJ, USA: Prentice Hall, 2005.
51. CERT Coordination Center. (Sep. 1996). CERT Advisory CA 1996-21, TCP SYN Flooding and IP Spoofing Attacks. [Online]. Available: http://www.cert.org/historical/advisories/CA-1996-21.cfm, accessed Nov. 2000.
52. Y. Guo, C.-W. Ten, S. Hu, and W. Weaver, "Modeling distributed denial of service attack in advanced metering infrastructure," in Proc. IEEE PES Innov. Smart Grid Technol., Washington, DC, USA, Feb. 2015, pp. 1-5.
53. L. P. Kaelbling, M. L. Littman, and A. R. Cassandra, "Planning and acting in partially observable stochastic domains," Artif. Intell., vol. 101, nos. 1-2, pp. 99-134, 1998.
54. A. R. Cassandra. (May 2015). POMDP Solver Software, Version 5.3. [Online]. Available: http://www.pomdp.org/code/index.shtml