Substation-Aware. An intrusion detection system for the IEC 61850 protocol.

Jose Antonio Lopez; Iñaki Angulo; Saturnino Martinez

doi:10.1145/3538969.3543818

Substation-Aware. An intrusion detection system for the IEC 61850 protocol.

Jose Antonio Lopez, Iñaki Angulo, Saturnino Martinez

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

2 Downloads (Pure)

Abstract

The number of cyberattacks against the Smart Grid has increased in the last years. Considered as a critical infrastructure, power system operators must improve the cybersecurity countermeasures of their installations. Intrusion Detection Systems (IDS) appears as a promising solution to detect hidden activity of the hackers before launching the attack. Most detection tools are generalist, designed to find predefined patterns such as frequency of messages, well-known malware packets, source and destination of the messages or the content of each packet itself. These tools also allow plugging modules for different protocols, offering a better understanding of the analysed data, such as the protocol action (read, write, reset...) or data model/schema understanding. However, the semantics of the data transmitted cannot be inferred. The Substation-Aware (SBT-Aware) tool adds the latest feature for primary and secondary substations, taking into account not only the protocols defined in the IEC 61850 standard, but the substation topology as well. In this paper we present the SBT-Aware, an IDS that has been developed and tested in the course of the H2020 SDN-microSENSE project.

Original language	English
Title of host publication	unknown
Publisher	Association for Computing Machinery
Pages	1-7
Number of pages	7
ISBN (Electronic)	9781450396707
ISBN (Print)	978-145039670-7
DOIs	https://doi.org/10.1145/3538969.3543818
Publication status	Published - 23 Aug 2022
Event	17th International Conference on Availability, Reliability and Security, ARES 2022 - Vienna, Austria Duration: 23 Aug 2022 → 26 Aug 2022

Publication series

Name	ACM International Conference Proceeding Series

Conference

Conference	17th International Conference on Availability, Reliability and Security, ARES 2022
Country/Territory	Austria
City	Vienna
Period	23/08/22 → 26/08/22

Keywords

IEC 61850
Substation protection
Cybersecurity

Project and Funding Information

Project ID
info:eu-repo/grantAgreement/EC/H2020/833955/EU/SDN - microgrid reSilient Electrical eNergy SystEm/SDN-microSENSE
Funding Info
The research presented has been done in the context of SDN-microSENSE project. SDN-microSENSE has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No 833955. The information contained in this publication reflects only the authors’ view. EC is not responsible for any use that may be made of this information.

Access to Document

10.1145/3538969.3543818

3538969Final published version, 890 KB

Cite this

@inproceedings{c4431229ab1144c2a7556a54ebc6563c,

title = "Substation-Aware. An intrusion detection system for the IEC 61850 protocol.",

abstract = "The number of cyberattacks against the Smart Grid has increased in the last years. Considered as a critical infrastructure, power system operators must improve the cybersecurity countermeasures of their installations. Intrusion Detection Systems (IDS) appears as a promising solution to detect hidden activity of the hackers before launching the attack. Most detection tools are generalist, designed to find predefined patterns such as frequency of messages, well-known malware packets, source and destination of the messages or the content of each packet itself. These tools also allow plugging modules for different protocols, offering a better understanding of the analysed data, such as the protocol action (read, write, reset...) or data model/schema understanding. However, the semantics of the data transmitted cannot be inferred. The Substation-Aware (SBT-Aware) tool adds the latest feature for primary and secondary substations, taking into account not only the protocols defined in the IEC 61850 standard, but the substation topology as well. In this paper we present the SBT-Aware, an IDS that has been developed and tested in the course of the H2020 SDN-microSENSE project.",

keywords = "IEC 61850, Substation protection, Cybersecurity, IEC 61850, Substation protection, Cybersecurity",

author = "Lopez, {Jose Antonio} and I{\~n}aki Angulo and Saturnino Martinez",

note = "Publisher Copyright: {\textcopyright} 2022 Owner/Author.; 17th International Conference on Availability, Reliability and Security, ARES 2022 ; Conference date: 23-08-2022 Through 26-08-2022",

year = "2022",

month = aug,

day = "23",

doi = "10.1145/3538969.3543818",

language = "English",

isbn = "978-145039670-7",

series = "ACM International Conference Proceeding Series",

publisher = "Association for Computing Machinery",

pages = "1--7",

booktitle = "unknown",

}

Lopez, JA , Angulo, I & Martinez, S 2022, Substation-Aware. An intrusion detection system for the IEC 61850 protocol. in unknown. ACM International Conference Proceeding Series, Association for Computing Machinery, pp. 1-7, 17th International Conference on Availability, Reliability and Security, ARES 2022, Vienna, Austria, 23/08/22. https://doi.org/10.1145/3538969.3543818

TY - GEN

T1 - Substation-Aware. An intrusion detection system for the IEC 61850 protocol.

AU - Lopez, Jose Antonio

AU - Angulo, Iñaki

AU - Martinez, Saturnino

PY - 2022/8/23

Y1 - 2022/8/23

N2 - The number of cyberattacks against the Smart Grid has increased in the last years. Considered as a critical infrastructure, power system operators must improve the cybersecurity countermeasures of their installations. Intrusion Detection Systems (IDS) appears as a promising solution to detect hidden activity of the hackers before launching the attack. Most detection tools are generalist, designed to find predefined patterns such as frequency of messages, well-known malware packets, source and destination of the messages or the content of each packet itself. These tools also allow plugging modules for different protocols, offering a better understanding of the analysed data, such as the protocol action (read, write, reset...) or data model/schema understanding. However, the semantics of the data transmitted cannot be inferred. The Substation-Aware (SBT-Aware) tool adds the latest feature for primary and secondary substations, taking into account not only the protocols defined in the IEC 61850 standard, but the substation topology as well. In this paper we present the SBT-Aware, an IDS that has been developed and tested in the course of the H2020 SDN-microSENSE project.

AB - The number of cyberattacks against the Smart Grid has increased in the last years. Considered as a critical infrastructure, power system operators must improve the cybersecurity countermeasures of their installations. Intrusion Detection Systems (IDS) appears as a promising solution to detect hidden activity of the hackers before launching the attack. Most detection tools are generalist, designed to find predefined patterns such as frequency of messages, well-known malware packets, source and destination of the messages or the content of each packet itself. These tools also allow plugging modules for different protocols, offering a better understanding of the analysed data, such as the protocol action (read, write, reset...) or data model/schema understanding. However, the semantics of the data transmitted cannot be inferred. The Substation-Aware (SBT-Aware) tool adds the latest feature for primary and secondary substations, taking into account not only the protocols defined in the IEC 61850 standard, but the substation topology as well. In this paper we present the SBT-Aware, an IDS that has been developed and tested in the course of the H2020 SDN-microSENSE project.

KW - IEC 61850

KW - Substation protection

KW - Cybersecurity

KW - IEC 61850

KW - Substation protection

KW - Cybersecurity

UR - http://www.scopus.com/inward/record.url?scp=85136994587&partnerID=8YFLogxK

U2 - 10.1145/3538969.3543818

DO - 10.1145/3538969.3543818

M3 - Conference contribution

SN - 978-145039670-7

T3 - ACM International Conference Proceeding Series

SP - 1

EP - 7

BT - unknown

PB - Association for Computing Machinery

T2 - 17th International Conference on Availability, Reliability and Security, ARES 2022

Y2 - 23 August 2022 through 26 August 2022

ER -

Substation-Aware. An intrusion detection system for the IEC 61850 protocol.

Abstract

Publication series

Conference

Keywords

Project and Funding Information

Access to Document

Other files and links

Fingerprint

Cite this