Search

Important components of the electric energy distribution systems are primary and secondary substations. Due to the incorporation of legacy communication infrastructure in these systems, they often have inherent cyber-security vulnerabilities. Further, traditional intrusion defence strategies for IT systems are often not applicable. In order to improve cyber-security in substation networks, this paper presents a neural net-based monitoring system. Further, to evaluate the applicability of the system, all experiments were conducted on a real test bed, which represents the substation domain as close as possible to reality. The proposed monitoring system covers several tasks. First, relevant network packets are acquired from network traffic and analysed. Based on these packets statistical features are extracted. Then, classes are defined, and a normal behaviour model of the network is trained by the neural net. New network traffic is compared to the model, in order to determine the nature of the traffic and identify potential anomalies. Finally, the monitoring system is evaluated by conducting several supervised and unsupervised network attacks against the test bed.

In connection with anomaly detection in cyber-physical systems, we suggest in this paper a new way of modelling large systems consisting of a huge number of sensors, actuators and controllers. We base the approach on analytical methods usually used in kinetic gas theory, where one tries to describe the overall behaviour of a gas without looking at each molecule separately. We model the system as a multi-agent network and derive predictions on the behaviour of the network as a whole. These predictions can then be used to monitor the operation of the system. If the deviation between the predictions and the measured attributes of the operational cyber-physical system is sufficiently large, the monitoring system can raise an alarm. This way of modelling the normal behaviour of a cyber-physical system has the advantage over machine learning methods mainly used for this purpose, that it is not based on the effective operation of the system during a training phase, but rather on the specification of the system and its intended use. It will detect anomalies in the system’s operation independent of its source – may it be an attack, a malfunction or a faulty implementation.

In this paper we describe a novel approach to model smart meter networks aimed at analyzing security related aspects of such networks. The model is realized as a multi-agent based simulation. This allows for detailed analysis of network behaviour on different layers. The layers realized in the simulation are a protocol layer for syntactic analysis of the protocol, a data layer for semantic analysis of the commands transmitted, and an information layer where metering data is interpreted. The ultimate goal of the project is the design and proof-of-concept implementation of an innovative Intrusion Detection System specifically apt for smart meter networks. The simulation described in this paper together with data from real world field tests will be used to deduce formal rules describing regular behaviour of the network which then will be the input for the IDS.