Publication Details

Flow based monitoring of ICS communication in the smart grid

MATOUŠEK, P.; RYŠAVÝ, O.; HAVLENA, V.; GRÉGR, M. Flow based monitoring of ICS communication in the smart grid. Journal of Information Security and Applications, 2020, vol. 2020, no. 54, p. 102535-102535. ISSN: 2214-2126.
Czech title
Monitorování řídící komunikace v energetických provozech pomocí toků
Type
journal article
Language
English
Authors
Matoušek Petr, doc. Ing., Ph.D., M.A. (DIFS)
Ryšavý Ondřej, doc. Ing., Ph.D. (DIFS)
Havlena Vojtěch, Ing., Ph.D. (DITS)
Grégr Matěj, Ing., Ph.D. (DIFS)
URL
Keywords


IEC 104, smart grid, security monitoring, SCADA, probabilistic automata

Abstract

A smart grid network is a part of critical infrastructure, and its interruption
or blackout may cause fatal consequences on energy production, distribution, and
eventually lives of people. Smart grid networks can be a target of cyber attacks
coming from the outside or the inside of the network. Traditional smart grid
protection includes firewalls and IDS/IPS devices that are usually deployed on
edges of the network where they inspect incoming and outgoing traffic. This
approach is adequate to cope with external threats. In case of internal threats
caused by, for instance, the malware infecting the control station, it is not
easy to detect malicious activity commonly masked as legitimate communication at
the network edge. For the successful identification of cyber security attacks,
two essential elements are necessary.

The first is the visibility of the Industrial Control System (ICS) communication,
which enables a smart grid operator to see real-time transmissions in the
network. The second important part is an anomaly detection system that analyzes
monitoring data and identifies possible cyber security attacks. This paper
presents a novel system for monitoring ICS/SCADA protocols based on IP flows
extended with application layer data obtained from ICS packet headers. The
monitoring system provides an in-depth insight into ICS communication. By
applying statistical-based methods or creating communication profiles using
probabilistic automata, common security attacks, as well as unknown threats, can
be identified. The proposed approach is demonstrated on IEC 60870-5-104
communication.

Published
2020
Pages
102535–102535
Journal
Journal of Information Security and Applications, vol. 2020, no. 54, ISSN 2214-2126
DOI
10.1016/j.jisa.2020.102535
UT WoS
000572992000011
EID Scopus
2-s2.0-85086142718
BibTeX 
@article{BUT168166,
  author="Petr {Matoušek} and Ondřej {Ryšavý} and Vojtěch {Havlena} and Matěj {Grégr}",
  title="Flow based monitoring of ICS communication in the smart grid",
  journal="Journal of Information Security and Applications",
  year="2020",
  volume="2020",
  number="54",
  pages="102535--102535",
  doi="10.1016/j.jisa.2020.102535",
  issn="2214-2126",
  url="http://www.sciencedirect.com/science/article/pii/S2214212619311329"
}
Files
Back to top