Abstract:Today’s electric power grid is a complex, automated, and interconnected cyber-physical system (CPS) that relies on supervisory control and data acquisition (SCADA)-based communication infrastructure for operating wide-area monitoring, protection, and control (WAMPAC) applications. With a push towards making the grid smarter, the critical SCADA infrastructure like power system is getting exposed to countless cyberattacks that necessitate the development of state-of-the-art intrusion detection systems (IDS) to provide comprehensive security solutions at different layers in the smart grid network. While considering the continuously evolving attack surfaces at physical, communication, and application layers, existing conventional IDS solutions are insufficient and incapable to resolve multi-dimensional cybersecurity threats because of their specific nature of the operation, either a data-centric or protocol-centric, to detect specific types of attacks. This chapter presents a hybrid intrusion detection system framework by integrating a network-based IDS, model-based IDS, and state-of-the-art machine learning-based IDS to detect unknown and stealthy cyberattacks targeting the SCADA networks. We have applied the cyber-kill model to develop and demonstrate attack vectors and their associated mechanisms. The hybrid IDS utilizes attack signatures in grid measurements and network packets as well as leverages secure phasor measurements to detect different stages of cyber-attacks while following the kill-chain process. As a proof of concept, we present the experimental case study in the context of centralized wide-area protection (CWAP) cybersecurity by utilizing resources of the PowerCyber testbed at Iowa State University (ISU). We also describe different classes of implemented cyber-attacks and generated heterogeneous datasets using the IEEE 39 bus system. Finally, the performance of the hybrid IDS is evaluated based in terms of detection rate in real-time cyber-physical environment.

Kill Chain for Industrial Control System

Insights on Cooperative Defense for Multiple Industrial Security Technologies

Research on Attack Mechanism of Network Intrusion in Industrial Control System

Network Security Situation Awareness for Industrial Control System under Integrity Attacks

Threat Assessment for Power Industrial Control System Based on Descriptive Vulnerability Text

Industrial control network security situation awareness based on improved C-SVC

Technical Aspects of Cyber Kill Chain

A Unified Architectural Approach for Cyberattack-Resilient Industrial Control Systems

Industrial Control Systems: Cyberattack trends and countermeasures

A Zoning-Based Secure Control Approach Against Actuator Attacks in Industrial Cyber-Physical Systems

Cyber Kill Chain-Based Hybrid Intrusion Detection System for Smart Grid

AI-based Identification of Most Critical Cyberattacks in Industrial Systems

Enhancing Industrial Control Network Security Through Vulnerability Detection and Attack Graph Analysis

The industrial control system cyber defence triage process

Securing Industrial Control Systems: Components, Cyber Threats, and Machine Learning-Driven Defense Strategies

Tecnicas Avanzadas de Ciberseguridad: Integracion y Evolucion de la Kill Chain en Diversos Escenarios

Cyber Security Issues of Critical Components for Industrial Control System

Vulnerabilities and Attacks Against Industrial Control Systems and Critical Infrastructures

A Deep Learning-based Framework for Conducting Stealthy Attacks in Industrial Control Systems

Threat and defense of new ransomware worm in industrial control system

Current cyber-defense trends in industrial control systems