Intrusion Detection Against MMS-Based Measurement Attacks at Digital Substations
Intrusion Detection Against MMS-Based Measurement Attacks at Digital Substations
复制标题
DOI：
10.1109/access.2020.3047341
复制
发表时间：
2021
期刊：
影响因子：
3.9
通讯作者：
Ruoxi Zhu;Chen-Ching Liu;Junho Hong;Jiankang Wang
中科院分区：
文献类型：
--
作者：
Ruoxi Zhu;Chen-Ching Liu;Junho Hong;Jiankang Wang
信息和通信技术 (ICT) 支持开发用于电力系统监测、操作和控制的新型控制和通信功能。然而，ICT的高水平部署也增加了监控和数据采集（SCADA）系统的网络入侵风险。攻击者可以访问受保护的电网基础设施并发起攻击来操纵变电站的测量结果。伪造的测量结果可能会误导控制中心的操作员采取不良行动。本文提出的入侵检测系统（IDS）部署在基于 IEC 61850 的变电站中。拟议的 IDS 可以识别制造消息传递规范 (MMS) 消息中的伪造测量结果。通过以分布式方式交叉检查变电站级电路关系的一致性，可以在恶意数据包通过 DNP3 通信发送出变电站之前检测并丢弃伪造的测量结果。网络物理系统测试台用于验证所提出的 IDS 的性能。使用 IEEE 39 总线测试系统，仿真结果证明了所提出的基于变电站的入侵检测系统的高精度。
Information and Communications Technology (ICT) supports the development of novel control and communication functions for monitoring, operation, and control of power systems. However, the high-level deployment of ICT also increases the risk of cyber intrusions for Supervisory Control And Data Acquisition (SCADA) systems. Attackers can gain access to the protected infrastructures of the grid and launch attacks to manipulate measurements at the substations. The fabricated measurements can mislead the operators in the control center to take undesirable actions. The Intrusion Detection System (IDS) proposed in this paper is deployed in IEC 61850 based substations. The proposed IDS identifies falsified measurements in Manufacturing Messaging Specification (MMS) messages. By cross-checking the consistency of electric circuit relationships at the substation level in a distributed manner, the falsified measurements can be detected and discarded before the malicious packets are sent out of the substations through DNP3 communication. A cyber-physical system testbed is used to validate the performance of the proposed IDS. Using the IEEE 39-bus test system, simulation results demonstrate high accuracy of the proposed substation-based intrusion detection system.