Search

Over recent years, we have seen a significant rise in electric mobility to overcome the anthropogenic emissions by conventional gasoline vehicles. However, the prerequisite of smoothening of peaks and imbalances through bidirectional charging is concatenated with the undesired impacts on reliability and security of power system operation when there are probable intrusions in the eXtreme Fast Charging (XFC) station, hence destabilizing the charging networks. So this paper applies STRIDE based threat modeling to analyze and identify multiple potential threats endured by the cyber-physical system (CPS) of XFC station by using weighted attack defense tree. Potential mitigation strategies are then suggested for the identified severe threats. In addition, this paper also develops a stochastic probabilistic tool, the Hidden Markov Model (HMM) for modeling the security attacks for a given range of identified attack vectors and hence employing an appropriate defense strategy against the malicious hacker. Also, a weighted attack defense tree has been developed to generate various attack scenarios. In the end, the results of the proposed work are substantiated and validated if it is able to considerably improve overall charging efficiency and cyber-physical security of the charging station network. [ABSTRACT FROM AUTHOR]

IEC61850 is the mainstream of the development for substation automation. This paper presents a practical consideration and analysis for implementing a secure sampled measured value (SeSV) message in substation automation system. Due to the lack of security features in the standard, IEC Working Group 15 of Technical Committee 57 published IEC62351 on security for IEC61850 profiles. However, the use of authentication methods for SV based on IEC62351 standards are still not integrated, and computational capabilities and performance are not validated and tested with commercial grade equipment. Hence, this paper shows the performance of security feature enabled SeSV packets transmitted between protection and control devices by appending a message authentication code (MAC) to the extended IEC61850 packets. A prototype implementation on a low cost commodity embedded system has proved that the MAC-enabled SV message can fully secure the process bus communication in the digital substation with negligible time delay. [ABSTRACT FROM AUTHOR]

This paper proposes new concepts for detecting and mitigating cyber attacks on substation automation systems by domain-based cyber–physical security solutions. The proposed methods form the basis of a distributed security domain layer that enables protection devices to collaboratively defend against cyber attacks at substations. The methods utilize protection coordination principles to cross check protection setting changes and can run real-time power system analysis to evaluate the impact of the control commands. The transient fault signature (TFS)-based cross-correlation coefficient algorithm has been proposed to detect the false sampled values data injection attack. The proposed functions were verified in a hardware-in-the-loop (HIL) simulation using commercial relays and a real-time digital simulator (RTDS). Various types of cyber intrusions are tested using this test bed to evaluate the consequences and impacts of cyber attacks to power grid as well as to validate the performance of the proposed research-grade cyber attack mitigation functions. [ABSTRACT FROM AUTHOR]

This paper proposes the new concept of intelligent electronic devices (IEDs) with built-in distributed intrusion detection systems. The proposed IEDs have the capabilities to monitor and detect anomalies and abnormal behaviors of the host system of IED and IEC 61850-based messages, e.g., sampled values and generic object oriented substation event. The proposed IEDs collaborate with neighboring IEDs to make an accurate decision and find the origin of cyber attacks. The commodity embedded system has been used to verify the performance of the proposed intrusion detection system with power system protection functions of IEDs. The results show that the proposed mitigation methods work accurately and efficiently with protection functions, e.g., overcurrent and distance protections, on the embedded board. [ABSTRACT FROM AUTHOR]

Cyber intrusions to substations are critical issues to a power grid, which must be defended and mitigated. Essentially, to better understand a cyber intrusion, reconnaissance activities should be modeled. Then, strategies of cyber attacker and defender can be studied, which help to identify substations vulnerable to cyber-attacks. In this paper, a successful intrusion is regarded as a probabilistic event related to reconnaissance activities. Its probability can be approximated by the Poisson distribution of the number of vulnerabilities discovered by the attacker. Furthermore, models of intrusion and defense in competition for control of the substations are proposed using Markov decision process (MDP). Key characteristics of target substation, attacker and defender are considered for determining probabilistic state transitions related to intrusion and defense actions. Thus, by solving the MDP models, the optimal strategies (action policies) of both the attacker and defender can be obtained. With these optimal strategies, the cyber security status of a substation can be evaluated within varied time frames. The case study validates the proposed models and method, including time-based strategies of the attacker and defender. [ABSTRACT FROM AUTHOR]

Cyber intrusions to substations of a power grid are a source of vulnerability since most substations are unmanned and with limited protection of the physical security. In the worst case, simultaneous intrusions into multiple substations can lead to severe cascading events, causing catastrophic power outages. In this paper, an integrated Anomaly Detection System (ADS) is proposed which contains host- and network-based anomaly detection systems for the substations, and simultaneous anomaly detection for multiple substations. Potential scenarios of simultaneous intrusions into the substations have been simulated using a substation automation testbed. The host-based anomaly detection considers temporal anomalies in the substation facilities, e.g., user-interfaces, Intelligent Electronic Devices (IEDs) and circuit breakers. The malicious behaviors of substation automation based on multicast messages, e.g., Generic Object Oriented Substation Event (GOOSE) and Sampled Measured Value (SMV), are incorporated in the proposed network-based anomaly detection. The proposed simultaneous intrusion detection method is able to identify the same type of attacks at multiple substations and their locations. The result is a new integrated tool for detection and mitigation of cyber intrusions at a single substation or multiple substations of a power grid. [ABSTRACT FROM PUBLISHER]

Cybersecurity of the substations in a power system is a major issue as the substations become increasingly dependent on computer and communication networks. This paper is concerned with anomaly detection in the computer network environment of a substation. An anomaly inference algorithm is proposed for early detection of cyber-intrusions at the substations. The potential scenario of simultaneous intrusions launched over multiple substations is considered. The proposed detection method considers temporal anomalies. Potential intrusion events are ranked based on the credibility impact on the power system. Snapshots of anomaly entities at substations are described. Simulation results using the modified IEEE 118-bus system have shown the effectiveness of the proposed method for systematic identification. The result of this research is a tool to detect cyber-intrusions that are likely to cause significant damages to the power grid. [ABSTRACT FROM PUBLISHER]

A POWER GRID IS A CRITICAL INFRASTRUCTURE THAT RELIES ON SUPERVISORY control and data acquisition (SCADA) systems for monitoring, control, and operation. On top of the power infrastructure reside layers of information and communications technology (ICT) that are interconnected with electric grids. The cyber and power infrastructures together constitute a large, complex cyberphysical system. ICTs on the power grids have evolved from isolated structures into open and networked environments based on TCP/IP and Ethernet. The technology is known to be vulnerable with respect to cyberintrusions. As ICTs of the power infrastructure have evolved into highly connected network environments, the use of firewalls has become a widely adopted access control method against intruders. Firewalls do not guarantee cybersecurity, however. The misconfiguration of company firewalls has been reported. Even if the configuration of a firewall is correct, it is still vulnerable because firewalls are not able to detect insider attacks and connections from the trusted side. Hence, solutions based solely on firewalls can be inadequate. [ABSTRACT FROM PUBLISHER]