Sensor Data Analytics for Intrusion Detection Tech Tesfay, Prof. - - PowerPoint PPT Presentation

▶
sensor data analytics for intrusion detection
SMART_READER_LITE
LIVE PREVIEW

Sensor Data Analytics for Intrusion Detection Tech Tesfay, Prof. - - PowerPoint PPT Presentation

Apr 30, 2023 132 likes •485 views

Sensor Data Analytics for Intrusion Detection Tech Tesfay, Prof. Anna Scaglione Tech Tesfay, Prof. Anna Scaglione (ASU) Mar. 30, 2018 1 / 29 Outline Motivation for cyber-physical intrusion detection Reconnaissance activity identification

slide-1
SLIDE 1

Sensor Data Analytics for Intrusion Detection

Tech Tesfay,

  • Prof. Anna Scaglione

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

1 / 29

slide-2
SLIDE 2

Outline

Motivation for cyber-physical intrusion detection Reconnaissance activity identification using:

Fog computing: at the network age using Th´ evenin source impedance Cloud computing: at the control centre using data from multiple input sources

Grand vision: automated threat detection by leveraging data from

  • ther sources

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

2 / 29

slide-3
SLIDE 3

Motivation

“Whatever can go wrong, will go wrong” Murphy’s law. There will be security breaches no matter how much protection is put in place. Even worse, most utilities have not put security in place. Example: Ukraine power grid attack, Stuxnet malware, US power grid breach report .... Attacks - system diverges from the safe operating limits 1. Solution: Put (additional) security measures to counter such attacks?

1cardenas2011attacks Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

3 / 29

slide-4
SLIDE 4

Our approach

Use intrusion detection to detect malicious activities: Leverage knowledge of the physical laws governing the safe operating limits. Use high resolution (µPMU) measurements. Use mirrored SCADA packet.

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

4 / 29

slide-5
SLIDE 5

Not so easy to accomplish!

Intrusion detection is a challenging task given the following challenges:

Challenges

Insufficient number of µPMUs (lack of full system observability), Need for real-time analysis (latency of centralized analytics), Inaccuracy of the grid parameters in the database (time-varying/human errors) Designing appropriate rules to correlate data from different sources and output the correct security status of the grid

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

5 / 29

slide-6
SLIDE 6

Hierarchical intrusion detection architecture

Fog computing

data analysis at the network edge (local rules), near real-time analysis (1 sec in

  • ur case),

prioritizing communication of eventful segments,

Cloud computing

co-analysis of data from multiple sensors (central rules) event localization and categorization (natural vs malicious anomaly)

Control Center

PMUs/SCADA Packet Sniffer

Cloud Computing Fog Computing

Figure: Intrusion Detection

Architecture.

1jamei2016micro Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

6 / 29

slide-7
SLIDE 7

Reconnaissance activity identification using fog computing

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

7 / 29

slide-8
SLIDE 8

Case study: Reconnaissance through Th´ evenin estimation

Normally-open switch at a substation is a good point for attacker to gauge its controllability over SCADA network by toggling the switch status. Can we identify this specific reconnaissance activity?

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

8 / 29

slide-9
SLIDE 9

Case study: Reconnaissance through Th´ evenin estimation

Insight

The Th´ evenin impedance upstream seen from a distribution substation is dominated by the transformer impedance Implication: The upstream Th´ evenin impedance for “closed-switch” is almost half of the value when the switch is “open”

Goal

Online Tracking of Th´ evenin source impedance using after transformer substation µPMU data

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

8 / 29

slide-10
SLIDE 10

Related work on Th´ evenin estimation:

Least-square methods 1,2,3,4,5. Addressing the quasi steady-state adverse effect on Th´ evenin estimation6,7. Th´ evenin circuit estimation in a three-phase unbalanced distribution grid 8 using RMS volatge values.

1vu1999use 2smon2006local 3tsai2008line 4parniani2006voltage 5arefifar2009online 6abdelkader2012online 7alinejadline 8hart1986characterising Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

9 / 29

slide-11
SLIDE 11

Our Contributions

First to utilize Th´ evenin parameter for reconnaissance activity identification Online estimation of Th´ evenin parameters in a balanced/unbalanced grid, Proposing a robust algorithm for non-stationary and correlated data. Removing the inaccurate common assumption of constant Th´ evenin voltage angle over a short window

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

10 / 29

slide-12
SLIDE 12

Th´ evenin Equivalent Circuit

th

E

th

Z

Bus1 Subtransmission/ Distribution Feeder Transmission Thevenin Equivalent PMU/μPMU

v i

Figure: Transmission Grid Th´

evenin Equivalent Seen from Substation

v[k] = Eth[k] − Zth[k]i[k] (1) In the sequence domain, assuming transposed lines in the transmission level:   v0[k] v1[k] v2[k]  =   E1[k]  −   Z0[k] Z1[k] Z2[k]     i0[k] i1[k] i2[k]   . (2)

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

11 / 29

slide-13
SLIDE 13

Estimation: Unbalanced Grid

Taking advantage of unbalanced data Assuming Z1[k] ≈ Z2[k]: Z0[k] = −v0[k] i0[k] , Z1[k] = −v2[k] i2[k] , E1[k] = v1[k]i2[k] − v2[k]i1[k] i2[k] . (3) Estimation at each instant of time only depends on the measurements

  • f that time-instant.

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

12 / 29

slide-14
SLIDE 14

Estimation: Balanced Grid

The only non-trivial equation is: v1[k] = E1[k] − Z1[k]i1[k] (4) Assumption: The resistive part of the Th´ evenin impedance is negligible compared to the inductive part.

  v jXi E

Figure: Phasor Diagram of the Equivalent Th´

evenin Circuit for Balanced Grid.

Let A[k] = |E[k]| and iim be the imaginary component of the current, then we have: A2[k] − v2[k] − X 2[k]|i[k]|2 + 2iim[k]X[k]v[k]

  • r(A,X;k)

= 0 (5)

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

13 / 29

slide-15
SLIDE 15

Estimation: Balanced Grid

we form the following M over-determined homogeneous set of quad. equations:      r(A, X; k − M + 1) r(A, X; k − M + 2) . . . r(A, X; k)     

  • r(A,X;k)

=      . . .      (4) Minimize the squared-norm of the vector r(A, X; k): min

θ[k] f (A, X; k) = 1

2|| r(A, X; k)||2 (5) where θ[k] = [A[k], X[k]]T.

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

13 / 29

slide-16
SLIDE 16

Estimation: Balanced Grid

Advantages of our formulation: Having the assumption of constant Th´ evenin voltage phase angle over a window of M samples is not needed Reporting phasor angles relative to the voltage phasor angle removes the effect of off-nominal frequency

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

13 / 29

slide-17
SLIDE 17

Estimation: Balanced Grid

The Levenberg-Marquardt Algorithm (LMA) is used to solve the non-linear least square problem.

Advantages:

1 handling close to rank-deficient matrices, 2 better performance compared to Gauss-Newton for a bad initial guess. Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

13 / 29

slide-18
SLIDE 18

LMA

Algorithm 1: LMA at time instant k Input: r(A, X; k), and an initial guess θ0[k] Output: Th´ evenin parameters at time k begin flag ← 1; initialize ρ < 1, λ, and ǫ ; θ[k] ← θ0[k]; while flag=1 do J = ∇ r(θ; k); PLM ← −(JTJ + λdiag(JTJ))−1JT r(θ; k); θnew[k] ← θ[k] + PLM; if f (θnew; k) < f (θ; k) then λ ← ρλ; θ[k] ← θnew[k]; else λ ← λ

ρ;

if f (θ; k) < ǫ then flag ← 0; φ[k] ← sin−1(X[k]ir[k]/A[k]) return E[k], X[k];

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

14 / 29

slide-19
SLIDE 19

Numerical Results: Unbalanced Grid

1 115/24.9 KV YN-YN T tr

Z

th

E

μPMU Added Section IEEE 34-Bus Feeder

Figure: Modified IEEE-34 Bus Test Case

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

15 / 29

slide-20
SLIDE 20

Numerical Results: Unbalanced Grid

Estimated Actual Z0 2.5533 + j9.4392 2.5716 + j9.4320 Z1 2.9922 + j10.92 2.99 + j10.8901

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

15 / 29

slide-21
SLIDE 21

Numerical Results: Balanced Grid

New-England test-case, load ramp event of +2%/sec at load bus 16.

54.5 55 55.5 56 56.5 57 57.5 58

Time (Sec)

5 10 15 20 25 30

Reactance(Ohm) Estimated Thevenin Reactance Estimated Actual

Figure: Estimated Th´

evenin Reactance Seen from Bus 16 of New England Test Case Using LMA Method.

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

16 / 29

slide-22
SLIDE 22

Application : Reconnaissance Activity Identification

Figure: Substation Main-Spare

Transformer Setup

Estimated Positive Sequence Thevenin Impedance

0.1 0.2 0.3 0.4 0.5

Time (Sec)

1 2 3 4 5

Re(Z1) Ohm

Estimated Actual (Switch Open) Actual (Switch Close) 0.1 0.2 0.3 0.4 0.5

Time (Sec)

5 10 15

Im(Z1) Ohm

Estimated Actual (Switch Open) Actual (Switch Close)

Figure: Estimated Th´

evenin Source Impedance

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

17 / 29

slide-23
SLIDE 23

Reconnaissance activity identification using cloud computing

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

18 / 29

slide-24
SLIDE 24

Steps: Analyse event using data from multiple µPMU Integrate SCADA data in the analysis for event categorization (natural vs malicious anomaly).

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

19 / 29

slide-25
SLIDE 25

Case study: Reconnaissance identification on FLISR

Goal: Run Fault Location, Isolation, and Service Restoration (FLISR) algorithm using µPMU measurements. Detect malicious activities through identification of inconsistencies between µPMU data analytics and SCADA data.

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

20 / 29

slide-26
SLIDE 26

Example: FLISR

µPMU data analytics identifies fault on line 4 − 5. Data injection attacks on SCADA data

Blocking fault detector packets, Altering detected fault location, Jamming or altering the isolation commands.

SCADA information inconsistent with µPMU data analysis can inform

  • f ongoing attack.

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

21 / 29

slide-27
SLIDE 27

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

22 / 29

slide-28
SLIDE 28

Vision: Expanding the input scope

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

23 / 29

slide-29
SLIDE 29

Automated security information and event management (SIEM) system with more input data.

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

24 / 29

slide-30
SLIDE 30

The need for automation

Manual operations to secure a power grid network is challenging Too many legacy systems with no security features, Longer life span and difficult to keep track of security patches, Too many type of attacks to sufficiently identify and prepare for each attack, Human factor - weakest link! Automated threat detection and identification is key!

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

25 / 29

slide-31
SLIDE 31

Continuous security

“If you know the enemy and know yourself, you need not fear the result of a hundred battles.” Sun Tzu, The art of war

Figure: Automated security information and event management (SIEM)

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

26 / 29

slide-32
SLIDE 32

Comments and/or possible collaborations are welcome!

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

27 / 29

slide-33
SLIDE 33

Related Publications

Jamei, Mahdi, Emma Stewart, Sean Peisert, Anna Scaglione, Chuck McParland, Ciaran Roberts, and Alex McEachern. “Micro Synchrophasor-Based Intrusion Detection in Automated Distribution Systems: Toward Critical Infrastructure Security.” IEEE Internet Computing 20, no. 5 (2016): 18-27. Jamei, Mahdi, Anna Scaglione, Ciaran Roberts, Emma Stewart, Sean Peisert, Chuck McParland, and Alex McEachern. ”Anomaly Detection Using Optimally-Placed Micro-PMU Sensors in Distribution Grids.” IEEE Transactions on Power System (2017). Jamei, Mahdi, Anna Scaglione, Ciaran Roberts, Alex McEachern, Sean Peisert, Emma Stewart, and Chuck McParland. “Online Thevenin Parameter Tracking Using Synchrophasor Data.” Accepted in IEEE PES GM 2017. Jamei, Mahdi, Anna Scaglione, Ciaran Roberts, Emma Stewart, Sean Peisert, Chuck McParland, and Alex McEachern. “Automated Anomaly Detection in Distribution Grids Using uPMU Measurements.” In Proceedings

  • f the 50th Hawaii International Conference on System Sciences. 2017.

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

28 / 29

slide-34
SLIDE 34

Thank You! Questions?

Tech Tesfay, Prof. Anna Scaglione (ASU)

  • Mar. 30, 2018

29 / 29