Publication Details
Increasing Visibility of IEC 104 Communication in the Smart Grid
Ryšavý Ondřej, doc. Ing., Ph.D. (DIFS)
Grégr Matěj, Ing., Ph.D. (DIFS)
IEC 104, smart grid, ICS, security monitoring, SCADA, flow monitoring
Energy systems like smart grids are part of critical infrastructure and their
interruption or blackout may have fatal consequences on energy production,
distribution, and eventually the life of individual people. In order to secure
communication in Industrial Control Systems (ICS) and detect cyber attacks on
smart grids, we need to increase visibility of ICS communication so that an
operator can see what commands are sent between ICS devices. Security monitoring
of ICS transmission requires (i) retrieving monitoring data from ICS packets,
(ii) processing and analyzing extracted data, (iii) visualizing the passing
communication to the operator. The proposed work presents a concept of ICS flow
monitoring system that extracts meta data from ICS packet headers and creates ICS
flow records similarly to Netflow/IPFIX system. ICS flows represent communication
in the smart grid network that is further visualized using dashboard and
communication charts. Unlike traditional monitoring approach that works with
network and transport layer data only, we extend flow monitoring to application
layer with focus on ICS protocols. The proposed approach is demonstrated on
monitoring IEC 60870-5-104 communication.
@inproceedings{BUT159977,
author="Petr {Matoušek} and Ondřej {Ryšavý} and Matěj {Grégr}",
title="Increasing Visibility of IEC 104 Communication in the Smart Grid",
booktitle="6th International Symposium for ICS & SCADA Cyber Security Research 2019",
year="2019",
pages="21--30",
publisher="BCS Learning and Development Ltd.",
address="Swindon",
doi="10.14236/ewic/icscsr19.3",
isbn="978-1-78017-523-2",
url="https://www.scienceopen.com/document?vid=0ba50e72-98fe-4bbf-b683-6107a28c4df4"
}