Search

Currently, the architecture of Line Current Differential Relays (LCDRs) is designed to respond to internal faults on the protected line using local and remotely-communicated current measurements. However, this architecture cannot distinguish between real faults and cyber-induced attacks whose goal is to cause false tripping of the line protected by the LCDR. In this paper, we propose an Anomaly-Based Scheme (ABS) for detecting false-tripping attacks against LCDRs, in the form of relay attacks, replay attacks, general false-data-injection attacks, and time-synchronization attacks. The ABS employs the Isolation Forest algorithm, which is trained on features determined from local current measurements to confirm real faults and differentiate them from false-tripping attacks. No trip command will be issued unless the sensed fault is confirmed as a non-attack by the ABS. The performance of the proposed ABS is tested and validated using the IEEE 9-bus benchmark in PSCAD/EMTDC environment. Simulation results show that the proposed ABS: (i) can accurately detect different categories of cyberattacks, (ii) does not negatively impact the accuracy of the fault-detection function, and (iii) is robust to the change in the power system’s operating point. [ABSTRACT FROM AUTHOR]

Traditional cryptographic approaches may not always be suitable for cyber–physical systems (CPSs). In this correspondence, we present a control-theoretic approach allowing a networked controller and a smart actuator of a stochastic CPS to agree on a common secret key without resorting to classical cryptographic approaches. More precisely, by utilizing the asymmetry in the system model knowledge available to the control system defender and to the eavesdropper, we propose a key-agreement scheme utilizing a simultaneous input and state estimation algorithm. The validity of the proposed solution is shown through a numerical example. [ABSTRACT FROM AUTHOR]

The recent advances and unprecedented ubiquity of computation-intensive applications such as virtual reality and mobile augmented reality force new approaches to handle the accompanying challenges. Ultra-Dense Network (UDN) as a leading direction in 5G and beyond offers an opportunistic degree of freedom to be exploited where a massive number of low-power and low-cost Small Cells (SCs) are deployed. In particular, integrating Edge Computing Servers (ECSs) within the SCs at the edge of the cellular network paves the way to tackle several challenges including the processing of computation-intensive tasks with low latency. To exploit the full potentials of UDNs and ECSs, we deploy multiple associations of SCs to the same user while partitioning and offloading its computation-intensive task to the integrated ECSs therein. In this regard, we formulate a mathematical framework using tools from stochastic geometry to evaluate the average processing delay per user. Extensive Monte-Carlo simulations are conducted to verify the accuracy of our analytical results under different system parameters. Results show the existence of an optimal order of multiple-association. In addition, we propose a novel offline task division approach which significantly reduces the overall delay. [ABSTRACT FROM AUTHOR]

According to the IEC 62351-7 standard, data collection using network and system management (NSM) can be used to support the security monitoring of the smart grid. In this article, an NSM security monitoring platform for a realistic IEC 61850 substation model is developed using the specifications provided in IEC 62351-7. In the developed model, grid measurements are ready to take operative decisions, whereas collected NSM data are leveraged to detect cyberattacks and/or identify anomalies. The model includes power components (e.g., transformers, lines, and generators), controllers (e.g., voltage control), protection devices (e.g., overcurrent, distance, differential, and under/overvoltage), communication protocols (e.g., sampled value and generic object-oriented substation event), and NSM (e.g., agents and managers) applications. Moreover, a two-step deep learning framework is proposed for anomaly detection and cyberattack identification with enhanced accuracy. The first step can apply long short-term memory, recurrent neural network, and gated recurrent units, each in combination with an autoencoder. Then, the ensemble learning technique is used in the second step to augment the outputs of these deep learning models. To evaluate the effectiveness of the proposed cyberattack and anomaly detection framework, we detail and simulate potential cyberattacks targeting the performance of the IEEE 9-bus system. The proposed anomaly detection scheme can identify these threats using NSM data in a hardware-in-the-loop testbed. Finally, based on our assessment results, recommendations are provided for cybersecurity guidelines concerning IEC 62351-7. [ABSTRACT FROM AUTHOR]

As the penetration rate of flexible loads and distributed energy resources in the distribution networks increases, congestion management techniques that utilize demand-side management (DSM) have been developed. These are indirect methods that rely on information exchange between the distribution network operator, aggregators, and consumers’ meters to encourage customers to change their demand to relieve congestion. Cyber attacks against aggregators can compromise the operation of DSM-based congestion management methods, and hence, affect the security and reliability of electrical networks. In this article, the vulnerability of indirect congestion management methods to load-altering attacks is studied. An optimization algorithm is developed to determine the aggregators a cyber attacker would compromise, via minimum alteration of their load profiles, to cause congestion problems. The impact of such attacks on congestion and consumers’ electricity bill is then studied. A mitigation scheme is formulated to determine the most critical aggregators in the network. The security of these aggregators is then reinforced to mitigate such cyber attacks. [ABSTRACT FROM AUTHOR]

In this paper, we present a $\textsf {S}$ ymmetric $\textsf {K}$ ey $\textsf {I}$ nter- $\textsf {C}$ loud $\textsf {A}$ uthentication and redeemable micropayment $\textsf {P}$ rotocol ($\textsf {SKICAP}$) for IoT-Edge computing applications. The proposed protocol takes into account the mobile and limited resource nature of IoT devices by enabling them to register with their home cloud admin for computation offloading service provided by foreign Edge-Cloud instances. More precisely, $\textsf {SKICAP}$ ensures that mobile IoT devices can be authenticated and serviced by edge nodes outside of their home cloud coverage, while guaranteeing the associated charge redemption. Additionally, since our protocol considers the mobile and anywhere deployable requirements of IoT devices, we utilize physical unclonable function and cryptographic hash function to make it privacy-preserving and resilient to hardware compromise. Under the assumption of an indistinguishably secure physical unclonable function, we provide a formal security analysis of our protocol. Finally, we report $\textsf {SKICAP}$ performance on an ARM Cortex-A72 processor, and compare it with other closely related protocols. [ABSTRACT FROM AUTHOR]

Parental-control solutions often require dangerous privileges to function. We analyzed privacy/security risks of popular solutions and found that many leak personal information and are vulnerable to attacks, betraying the trust of parents and children. [ABSTRACT FROM AUTHOR]

Technical developments in communication technology and measurement synchronization have facilitated the design of advanced protection schemes, such as Line Current Differential Relays (LCDRs). However, the superior performance of LCDRs is achieved at the expense of exposing them to cyber-threats, since cyber-induced intrusions against protective relays—which take advantage of the direct control of relays over circuit-breakers—can cause protection system mis-operations. To address this problem, this paper presents a Learning-based Framework (LBF) for detecting False Data Injection Attacks (FDIAs) and Time Synchronization Attacks (TSAs) against LCDRs, and for differentiating them from faults. In the proposed LBF, a Multi-Layer Perceptron (MLP) model is trained based on differential and super-imposed features, which are selected using the Recursive Feature Elimination method. After implementing the proposed LBF in LCDRs, when an LCDR picks up, it initially extracts the features and sends them to the trained MLP model. The LCDR trips the line if the proposed LBF confirms a fault. The performance of the proposed LBF is corroborated using the IEEE 39-bus test system. Evaluation results show that the proposed LBF (i) works independently of a system's operating point and configuration, (ii) is not considerably affected by instrumentation errors, and (iii) can accurately detect FDIAs and TSAs. [ABSTRACT FROM AUTHOR]

Industrial Control Systems (ICSs) are cyber-physical systems that offer attractive targets to threat actors due to the scale of damages, both physical and cyber, that successful exploitation can cause. As such, ICSs often find themselves victims to reconnaissance campaigns - coordinated scanning activity that targets a wide subset of the Internet - that aim to discover vulnerable systems. As these campaigns likely scan broad netblocks of the Internet, some traffic is directed to network telescopes, which are routable, allocated, and unused IP space. In this paper, we explore the threat landscape of ICS devices by analyzing and investigating network telescope traffic. Our network traffic analysis tool takes darknet traffic and generates threat intelligence on scanning campaigns targeting ICSs in the form of campaign fragments, which we leverage in new ways to get more in-depth knowledge of the cybersecurity threats. We investigate the payloads of the identified campaigns using a custom Deep Packet Inspection (DPI) technique to dissect and analyze the packets. We found 13 distinct payload templates and deduced their purpose, and by extension the campaign goals. We use machine learning to classify the sources behind the campaigns and identify threat actors such as botnets, malicious attackers, or researchers, and establish a methodology to rank our campaigns to prioritize our analysis. To conduct our analysis of the threats targeting ICSs, we have leveraged 12.85 TB (330 days) of network traffic received by our observed darknet IP space. Combining these investigative threads, we provide a thorough overview of the threat landscape targeting ICS systems. [ABSTRACT FROM AUTHOR]

Coexistence of Human-Type Communications (HTCs) and Machine-Type Communications (MTCs) is inevitable. Ultra-Dense Networks (UDNs) will be efficacious in supporting both types of communications. In a UDN, a massive number of low-power and low-cost Small Cells (SCs) are deployed with density higher than that of the HTC users. In such a scenario, the backhaul capacities constitute an intrinsic bottleneck for the system. Hence, we propose a multiple association scheme where each HTC user associates to and activates multiple SCs to overcome the backhaul capacity constraints mainly encountered in the downlink. In addition, having more active cells allows for more MTC devices to be supported by the network. Using tools from stochastic geometry, we formulate a novel mathematical framework investigating the performance of HTC in both downlink and uplink as well as the uplink MTC. Stretched Exponential Path Loss (SEPL) model is considered to practically reflect the UDN environment. Extensive simulations were conducted to verify the accuracy of the mathematical analysis under different system parameters. Results show the existence of an optimum number of SCs to which an HTC user may connect under backhaul capacity constraints. Besides, the proposed multiple-association scheme improves the performance of MTC in terms of both ASE and density of supported devices. [ABSTRACT FROM AUTHOR]

The U.S. Department of Homeland Security (DHS) has recently identified digital relays as targets vulnerable to cyber-attacks. The DHS has also noted that attacks to multiple relays can bring about cascading outages of transmission lines, leading to blackouts. As a result, making protective relays cyber-resilient is a prominent security issue in power networks. Line current differential relays (LCDRs) are among the potentially vulnerable digital relays that are increasingly deployed for protecting critical transmission lines. LCDRs, however, lack the required resiliency against cyber attacks, due to their high dependence on communication systems. This paper unveils that such susceptibilities can result in unwarranted trip signals through false data injection attacks (FDIAs), and so cause instability if several attacks are coordinated. It also presents a solution for detecting FDIAs and distinguishing them from real internal faults. To detect attacks, the proposed method compares the estimated and locally measured voltages at an LCDR’s terminal for both the positive sequence (PS) and negative sequence (NS). To estimate the local voltage for each sequence, the proposed technique uses an unknown input observer (UIO), the state-space model of the faulty line, and remote and local measurements, all associated with that sequence. The difference between the measured and estimated local voltages for each sequence remains close to zero during real internal faults because, in this condition, the state-space model based on which the UIO operates correctly represents the line. Nevertheless, the state-space model mismatch during FDIAs leads to a large difference between measured and estimated values in both sequences. The effectiveness of the proposed method is corroborated using simulation results for the IEEE 39-bus network. [ABSTRACT FROM AUTHOR]

In this paper, we investigate the uplink coverage and ergodic capacity of massive Machine-Type Communication (mMTC) considering an Ultra-Dense Network (UDN) environment. In MTC, devices equipped with sensing, computation, and communication capabilities connect to the Internet providing what is known as Internet-of-Things (IoT). A dense network would provide an all-in-one solution where scalable connectivity, high capacity, and uniform deep coverage are byproducts. To account for short link distances, the path loss is modeled as stretched exponential path loss (SEPL). Moreover, the fading is modeled as a general $(\alpha -\mu)$ channel, where tractable and insightful results are derived for the Rayleigh fading special case. We consider the direct MTC access mode where mMTC nodes connect directly to the small cell. The analytical results disclose the impact of the system parameters and propagation environment parameters on the network performance. In particular, our results reveal that significant coverage enhancements and high uplink capacity are achievable at moderate cell densities, low transmission power, and moderate bandwidth. Moreover, the uplink network performance is independent of the maximum transmission power in the considered dense network scenario, allowing for longer battery lifetime of future IoT devices. The accuracy of the derived analytical results is assessed via extensive simulations. [ABSTRACT FROM AUTHOR]

The ability to maintain the system frequency within specified operating limits is crucial for the stability and proper operation of power systems. Any small deviation out of the permissible frequency range must be well-mitigated by the automatic generation control (AGC) system, otherwise it may result in disruption of operation and/or damage to the power grid equipment. The data required by the AGC control system is sent to the control center through communication links which are susceptible to cyber attacks. Therefore, such AGC systems have to be well-protected against false data injection (FDI) attacks. In this paper, the use of a simultaneous input and state estimation based algorithm to detect and concurrently compensate for FDI attacks against the measurements of AGC systems is investigated. Throughout the use of this algorithm, the FDI attack signal is dealt with as an unknown input and its value is estimated accordingly. Then, the estimated value for the FDI is used to compensate for the effect of the attack so that the control center makes its decision based on the corrected sensor signals, and not the manipulated ones. The proposed approach is tested under different types of FDI attacks and the simulation results for a 2-area and a 4-area practical system confirm its ability to detect, estimate FDI attacks and successfully compensate for it. [ABSTRACT FROM AUTHOR]

Integrating today's power systems with communication infrastructure makes them vulnerable to cyber-attacks, which can disrupt their normal operation undetectable. Automatic generation control (AGC) is one of the vulnerable controllers in power grids, since it greatly depends on communication systems. This paper first shows that false data injection attacks (FDIAs) against an AGC system can be carried out stealthily with destructive outcomes. Then, it proposes an anomaly based attack detection and identification method for protecting the AGC system against cyber vulnerabilities. To detect attacks, the proposed method estimates the load frequency control system's states using an unknown input observer (UIO), and calculates the UIO's residual function. A discrepancy between the residual functions and a predefined threshold signifies an FDIA. Different identification UIOs are then used to determine the attack type, i.e., which system parameter(s) is (are) targeted by the attack. The effectiveness of the proposed method is corroborated using simulation results for a three-area power system and the IEEE 39-bus network. [ABSTRACT FROM AUTHOR]