Detection of DoS Attacks Using ARFIMA Modeling of GOOSE Communication in IEC 61850 Substations
Integration of Information and Communication Technology (ICT) in modern smart grids (SGs) offers many advantages including the use of renewables and an effective way to protect, control and monitor the energy transmission and distribution. To reach an optimal operation of future energy systems, avai...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2020-10-01
|
| Series: | Energies |
| Subjects: | |
| Online Access: | https://www.mdpi.com/1996-1073/13/19/5176 |
| _version_ | 1797551805401399296 |
|---|---|
| author | Ghada Elbez Hubert B. Keller Atul Bohara Klara Nahrstedt Veit Hagenmeyer |
| author_facet | Ghada Elbez Hubert B. Keller Atul Bohara Klara Nahrstedt Veit Hagenmeyer |
| author_sort | Ghada Elbez |
| collection | DOAJ |
| description | Integration of Information and Communication Technology (ICT) in modern smart grids (SGs) offers many advantages including the use of renewables and an effective way to protect, control and monitor the energy transmission and distribution. To reach an optimal operation of future energy systems, availability, integrity and confidentiality of data should be guaranteed. Research on the cyber-physical security of electrical substations based on IEC 61850 is still at an early stage. In the present work, we first model the network traffic data in electrical substations, then, we present a statistical Anomaly Detection (AD) method to detect Denial of Service (DoS) attacks against the Generic Object Oriented Substation Event (GOOSE) network communication. According to interpretations on the self-similarity and the Long-Range Dependency (LRD) of the data, an Auto-Regressive Fractionally Integrated Moving Average (ARFIMA) model was shown to describe well the GOOSE communication in the substation process network. Based on this ARFIMA-model and in view of cyber-physical security, an effective model-based AD method is developed and analyzed. Two variants of the statistical AD considering statistical hypothesis testing based on the Generalized Likelihood Ratio Test (GLRT) and the cumulative sum (CUSUM) are presented to detect flooding attacks that might affect the availability of the data. Our work presents a novel AD method, with two different variants, tailored to the specific features of the GOOSE traffic in IEC 61850 substations. The statistical AD is capable of detecting anomalies at unknown change times under the realistic assumption of unknown model parameters. The performance of both variants of the AD method is validated and assessed using data collected from a simulation case study. We perform several Monte-Carlo simulations under different noise variances. The detection delay is provided for each detector and it represents the number of discrete time samples after which an anomaly is detected. In fact, our statistical AD method with both variants (CUSUM and GLRT) has around half the false positive rate and a smaller detection delay when compared with two of the closest works found in the literature. Our AD approach based on the GLRT detector has the smallest false positive rate among all considered approaches. Whereas, our AD approach based on the CUSUM test has the lowest false negative rate thus the best detection rate. Depending on the requirements as well as the costs of false alarms or missed anomalies, both variants of our statistical detection method can be used and are further analyzed using composite detection metrics. |
| first_indexed | 2024-03-10T15:51:17Z |
| format | Article |
| id | doaj.art-ecb3ec5fcf304e99959d99f8b62c0064 |
| institution | Directory Open Access Journal |
| issn | 1996-1073 |
| language | English |
| last_indexed | 2024-03-10T15:51:17Z |
| publishDate | 2020-10-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Energies |
| spelling | doaj.art-ecb3ec5fcf304e99959d99f8b62c00642023-11-20T16:06:18ZengMDPI AGEnergies1996-10732020-10-011319517610.3390/en13195176Detection of DoS Attacks Using ARFIMA Modeling of GOOSE Communication in IEC 61850 SubstationsGhada Elbez0Hubert B. Keller1Atul Bohara2Klara Nahrstedt3Veit Hagenmeyer4Institute of Automation and Applied Informatics (IAI), Karlsruhe Institute of Technology (KIT), Hermann-von-Helmholtz-Platz 1, 76344 Eggenstein-Leopoldshafen, GermanyInstitute of Automation and Applied Informatics (IAI), Karlsruhe Institute of Technology (KIT), Hermann-von-Helmholtz-Platz 1, 76344 Eggenstein-Leopoldshafen, GermanyInformation Trust Institute (ITI), University of Illinois at Urbana-Champaign (UIUC), 1206 W Clark St, Urbana, IL 61801, USAInformation Trust Institute (ITI), University of Illinois at Urbana-Champaign (UIUC), 1206 W Clark St, Urbana, IL 61801, USAInstitute of Automation and Applied Informatics (IAI), Karlsruhe Institute of Technology (KIT), Hermann-von-Helmholtz-Platz 1, 76344 Eggenstein-Leopoldshafen, GermanyIntegration of Information and Communication Technology (ICT) in modern smart grids (SGs) offers many advantages including the use of renewables and an effective way to protect, control and monitor the energy transmission and distribution. To reach an optimal operation of future energy systems, availability, integrity and confidentiality of data should be guaranteed. Research on the cyber-physical security of electrical substations based on IEC 61850 is still at an early stage. In the present work, we first model the network traffic data in electrical substations, then, we present a statistical Anomaly Detection (AD) method to detect Denial of Service (DoS) attacks against the Generic Object Oriented Substation Event (GOOSE) network communication. According to interpretations on the self-similarity and the Long-Range Dependency (LRD) of the data, an Auto-Regressive Fractionally Integrated Moving Average (ARFIMA) model was shown to describe well the GOOSE communication in the substation process network. Based on this ARFIMA-model and in view of cyber-physical security, an effective model-based AD method is developed and analyzed. Two variants of the statistical AD considering statistical hypothesis testing based on the Generalized Likelihood Ratio Test (GLRT) and the cumulative sum (CUSUM) are presented to detect flooding attacks that might affect the availability of the data. Our work presents a novel AD method, with two different variants, tailored to the specific features of the GOOSE traffic in IEC 61850 substations. The statistical AD is capable of detecting anomalies at unknown change times under the realistic assumption of unknown model parameters. The performance of both variants of the AD method is validated and assessed using data collected from a simulation case study. We perform several Monte-Carlo simulations under different noise variances. The detection delay is provided for each detector and it represents the number of discrete time samples after which an anomaly is detected. In fact, our statistical AD method with both variants (CUSUM and GLRT) has around half the false positive rate and a smaller detection delay when compared with two of the closest works found in the literature. Our AD approach based on the GLRT detector has the smallest false positive rate among all considered approaches. Whereas, our AD approach based on the CUSUM test has the lowest false negative rate thus the best detection rate. Depending on the requirements as well as the costs of false alarms or missed anomalies, both variants of our statistical detection method can be used and are further analyzed using composite detection metrics.https://www.mdpi.com/1996-1073/13/19/5176intrusion detectionmodel-based anomaly detectionsubstation communication networkIEC 61850 electrical substationsARFIMA modelcyber-physical security |
| spellingShingle | Ghada Elbez Hubert B. Keller Atul Bohara Klara Nahrstedt Veit Hagenmeyer Detection of DoS Attacks Using ARFIMA Modeling of GOOSE Communication in IEC 61850 Substations Energies intrusion detection model-based anomaly detection substation communication network IEC 61850 electrical substations ARFIMA model cyber-physical security |
| title | Detection of DoS Attacks Using ARFIMA Modeling of GOOSE Communication in IEC 61850 Substations |
| title_full | Detection of DoS Attacks Using ARFIMA Modeling of GOOSE Communication in IEC 61850 Substations |
| title_fullStr | Detection of DoS Attacks Using ARFIMA Modeling of GOOSE Communication in IEC 61850 Substations |
| title_full_unstemmed | Detection of DoS Attacks Using ARFIMA Modeling of GOOSE Communication in IEC 61850 Substations |
| title_short | Detection of DoS Attacks Using ARFIMA Modeling of GOOSE Communication in IEC 61850 Substations |
| title_sort | detection of dos attacks using arfima modeling of goose communication in iec 61850 substations |
| topic | intrusion detection model-based anomaly detection substation communication network IEC 61850 electrical substations ARFIMA model cyber-physical security |
| url | https://www.mdpi.com/1996-1073/13/19/5176 |
| work_keys_str_mv | AT ghadaelbez detectionofdosattacksusingarfimamodelingofgoosecommunicationiniec61850substations AT hubertbkeller detectionofdosattacksusingarfimamodelingofgoosecommunicationiniec61850substations AT atulbohara detectionofdosattacksusingarfimamodelingofgoosecommunicationiniec61850substations AT klaranahrstedt detectionofdosattacksusingarfimamodelingofgoosecommunicationiniec61850substations AT veithagenmeyer detectionofdosattacksusingarfimamodelingofgoosecommunicationiniec61850substations |