Accurate Automata-Based Detection of Cyber Threats in Smart Grid Communication

Accurate Automata-Based Detection of Cyber Threats in Smart Grid Communication

WoS Article

Several industry sectors, including critical infrastructure, have experienced severe cyber attacks against their Industrial Control  Systems (ICS) due to the malware that masqueraded itself as a legitimate ICS process and communicated with valid ICS messages. Such behavior is difficult to detect by standard techniques. Intrusion Detection Systems (IDS) usually filter illegitimate communication using pre-defined patterns while statistical-based Anomaly Detection Systems (ADS) mostly observe selected attributes of transmitted packets without deeper analysis of ICS messages.

We propose a new detection approach based on Deterministic Probabilistic Automata (DPAs) that capture the intended semantics of the ICS message exchange. The method models normal ICS message sequences using a set of DPAs representing expected traffic patterns. Then the detection system applies reasoning about the model to reveal a malicious activity in the ICS traffic expressed by unexpected ICS messages. In this paper, we significantly improve the performance of the automata-based detection method and reduce its false-positive rate. We also present a technique that produces additional details about detected anomalies, which is important for real-world deployment. The approach is demonstrated on IEC 104 or MMS communication from different ICS systems.

Several industry sectors, including critical infrastructure, have experienced severe cyber attacks against their Industrial Control  Systems (ICS) due to the malware that masqueraded itself as a legitimate ICS process and communicated with valid ICS messages. Such behavior is difficult to detect by standard techniques. Intrusion Detection Systems (IDS) usually filter illegitimate communication using pre-defined patterns while statistical-based Anomaly Detection Systems (ADS) mostly observe selected attributes of transmitted packets without deeper analysis of ICS messages.

We propose a new detection approach based on Deterministic Probabilistic Automata (DPAs) that capture the intended semantics of the ICS message exchange. The method models normal ICS message sequences using a set of DPAs representing expected traffic patterns. Then the detection system applies reasoning about the model to reveal a malicious activity in the ICS traffic expressed by unexpected ICS messages. In this paper, we significantly improve the performance of the automata-based detection method and reduce its false-positive rate. We also present a technique that produces additional details about detected anomalies, which is important for real-world deployment. The approach is demonstrated on IEC 104 or MMS communication from different ICS systems.

Smart grid, cyber security, anomaly detection, probabilistic automata, network flows, MITRE ATT&CK

Smart grid, cyber security, anomaly detection, probabilistic automata, network flows, MITRE ATT&CK

HAVLENA, V.; MATOUŠEK, P.; RYŠAVÝ, O.; HOLÍK, L.

2023

01.04.2023

1949-3053

IEEE Transactions on Smart Grid

2023

14

United States of America

2352

2366

15

https://ieeexplore.ieee.org/document/9927376

http://hdl.handle.net/

J2-obsah
Accurate_Automata-Based_Detection_of_Cyber_Threats_in_Smart_Grid_Communication