Detection and mitigation of cyber attacks in smart grid networks

Abstract

Smart grid networks use Supervisory Control and Data Acquisition (SCADA) systems for managing the grid network. These are critical infrastructure meeting energy demands of consumers. SCADA systems collect measurement data from different places of the grid network to make safety-critical control decisions. However, these networks use TCP/IP networks for transmitting such data and this has exposed them to cyber attacks, necessitating effective detection mechanisms. This thesis presents a three-fold contribution to enhancing the security of smart grids. In the first contribution, a comprehensive approach is taken to identify and address cyber threats in smart grid networks. Three broad classes of anomalies, namely single message anomaly, message sequencing anomaly, and time based anomaly, are introduced. We show that several cyber attacks in smart grid networks can be detected by identifying these three types of anomalies. A novel state transition machine model, Deterministic Counting Timed Automata (DCTA) is proposed to identify these anomalies. DCTA formalizes constraints on message attributes, event timing, and counter values associated with states, showcasing its efficacy in detecting cyber attacks. Experimental validation with a publicly available dataset establishes the capability of DCTA and its benchmarking against a recent method from the literature.