Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

On Process Awareness in Detecting Multi-stage Cyberattacks in Smart Grids

Omer Sen, Yanico Aust, Simon Glomb, Andreas Ulbig

TL;DR

This work addresses the rising cybersecurity risks in smart grids caused by extensive ICT integration by advocating for process-aware intrusion detection systems (IDS) that leverage domain knowledge of grid operations. It presents a co-simulation framework spanning IT, OT, and ET layers to evaluate ML-based IDS against multi-stage cyberattacks, using MITRE ATT&CK for ICS as the attack taxonomy and SHAP for explainability. The study demonstrates that process-aware IDS outperform IT-only approaches in detecting process-centric threats, such as IEC 104 manipulations, by fusing indicators across IT, OT, and ET and employing an ensemble meta-learning architecture. The findings highlight the need for richer IDS benchmarks and digital twin datasets in smart grid environments to improve resilience and enable practical deployment of explainable, robust anomaly detection.

Abstract

This study delves into the role of process awareness in enhancing intrusion detection within Smart Grids, considering the increasing fusion of ICT in power systems and the associated emerging threats. The research harnesses a co-simulation environment, encapsulating IT, OT, and ET layers, to model multi-stage cyberattacks and evaluate machine learning-based IDS strategies. The key observation is that process-aware IDS demonstrate superior detection capabilities, especially in scenarios closely tied to operational processes, as opposed to IT-only IDS. This improvement is notable in distinguishing complex cyber threats from regular IT activities. The findings underscore the significance of further developing sophisticated IDS benchmarks and digital twin datasets in Smart Grid environments, paving the way for more resilient cybersecurity infrastructures.

On Process Awareness in Detecting Multi-stage Cyberattacks in Smart Grids

TL;DR

This work addresses the rising cybersecurity risks in smart grids caused by extensive ICT integration by advocating for process-aware intrusion detection systems (IDS) that leverage domain knowledge of grid operations. It presents a co-simulation framework spanning IT, OT, and ET layers to evaluate ML-based IDS against multi-stage cyberattacks, using MITRE ATT&CK for ICS as the attack taxonomy and SHAP for explainability. The study demonstrates that process-aware IDS outperform IT-only approaches in detecting process-centric threats, such as IEC 104 manipulations, by fusing indicators across IT, OT, and ET and employing an ensemble meta-learning architecture. The findings highlight the need for richer IDS benchmarks and digital twin datasets in smart grid environments to improve resilience and enable practical deployment of explainable, robust anomaly detection.

Abstract

This study delves into the role of process awareness in enhancing intrusion detection within Smart Grids, considering the increasing fusion of ICT in power systems and the associated emerging threats. The research harnesses a co-simulation environment, encapsulating IT, OT, and ET layers, to model multi-stage cyberattacks and evaluate machine learning-based IDS strategies. The key observation is that process-aware IDS demonstrate superior detection capabilities, especially in scenarios closely tied to operational processes, as opposed to IT-only IDS. This improvement is notable in distinguishing complex cyber threats from regular IT activities. The findings underscore the significance of further developing sophisticated IDS benchmarks and digital twin datasets in Smart Grid environments, paving the way for more resilient cybersecurity infrastructures.

Paper Structure

This paper contains 15 sections, 8 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Process Awareness in IDS
  3. Intrusion Detection Systems
  4. Process Awareness
  5. Related Work
  6. Investigation Framework
  7. Overview
  8. Investigation Environment
  9. Multistage Attack Implementation
  10. IDS Implementation
  11. Investigation
  12. Scenario
  13. Case Studies
  14. Discussion
  15. Conclusion

Figures (8)

  • Figure 1: Illustration of ids integration into sg industrial control architecture and anomalies in the environment
  • Figure 2: Overview of the class diagrams of the co-simulation for the investigation of process-aware ids
  • Figure 3: Overview of the cigre-based scenario simulated in the co-simulation for the study: a) the co-simulation architecture and the components involved, b) the infrastructure model of the scenario and c) the specific network model for the case
  • Figure 4: Comparison between the it-only and process-aware ids in various scenarios
  • Figure 5: Feature analysis with a focus on it layer-specific attributes, representing the dos attack
  • ...and 3 more figures