SaTC: CORE: Medium: ADIDS: An Air-gapped Distributed Intrusion Detection System for the Power Grid

电网是一个高度复杂的控制系统，也是现代最令人印象深刻的工程壮举之一。现代社会的几乎每个方面都严重依赖于电网的正常运行，因此长时间甚至短时间的中断都可能给社会带来重大的经济和社会困难。目前的电网正在向智能电网转型，智能电网旨在监测和跟踪诊断和运行信息，从而使系统更高效、更有弹性。然而，这一重大转变使电网更容易受到网络罪犯的攻击，最近几次对电网的攻击突显了现代电力系统的脆弱性，特别是构成电网骨干的变电站。受此启发，该项目旨在开发实用的解决方案，以保护电力系统免受复杂的网络攻击。为电力系统变电站开发有效的入侵检测系统，以检测网络攻击和/或减少其破坏性后果，已经投入了大量精力。然而，现有技术要求监控和数据采集（SCADA）网络上的组件具有一定程度的信任，这使得它们容易受到可能危及SCADA系统的复杂攻击。本研究提出了一种基于气隙射频的分布式入侵检测系统（ADIDS），即使在整个SCADA系统被认为不可信的情况下，该系统仍然可靠。该系统有两个输入：SCADA网络通信量和变电站组件发出的射频信号。变电站的控制动作可以从它们产生的无线电信号中可靠地推断出来。无线电信号的完整性是通过对嵌入在信号中的准随机雷击的验证来提供的。如果配置得当，ADIDS能够在不依赖于SCADA网络本身的情况下验证SCADA网络流量的正确性。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

The power grid is a highly complex control system and one of the most impressive engineering feats of the modern era. Nearly every facet of modern society critically relies on the proper operation of the power grid such that long or even short interruptions can impose significant economic and social hardship on society. The current power grid is undergoing a transformation to a Smart Grid, that seeks to monitor and track diagnostic and operational information so as to enable a more efficient and resilient system. This significant transformation, however, has made the grid more susceptible to attacks by cybercriminals, as highlighted by several recent attacks on power grids that have exposed the vulnerabilities in modern power systems, especially power substations that form the backbone of electricity networks. Motivated by this, this project aims to develop practical solutions for securing the power system against sophisticated cyberattacks.Significant effort has been invested to develop effective intrusion detection systems for power system substations to detect cyberattacks and/or reduce their damaging consequences. Existing techniques, however, require some level of trust from components on the supervisory control and data acquisition (SCADA) network, rendering them vulnerable to sophisticated attacks that could compromise the SCADA system. This research presents an air-gapped radio frequency based distributed intrusion detection system (ADIDS) that remains reliable even when the entire SCADA system is considered untrusted. The system has two inputs: SCADA network traffic, and the radio frequency signals emitted by substation components. The control actions in substations can be reliably inferred from the radio signals they generate. The integrity of the radio signals is provided by the verification of quasi-random lightning strikes embedded in the signals. When properly configured, ADIDS is able to verify the correctness of the SCADA network traffic without relying on the SCADA network itself.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.