Home > Resources > Whitepapers > Integrated Anomaly Detection for Cyber Security of the Substations

Integrated Anomaly Detection for Cyber Security of the Substations

Cyber intrusions to substations of a power grid are a source of vulnerability since most substations are unmanned and with limited protection of the physical security. In the worst case, simultaneous intrusions into multiple substations can lead to severe cascading events, causing catastrophic power outages. In this paper, an integrated Anomaly Detection System (ADS) is proposed which contains host- and network-based anomaly detection systems for the substations, and simultaneous anomaly detection for multiple substations. Potential scenarios of simultaneous intrusions into the substations have been simulated using a substation automation testbed. The host-based anomaly detection considers temporal anomalies in the substation facilities, e.g., user-interfaces, Intelligent Electronic Devices (IEDs) and circuit breakers. The malicious behaviors of substation automation based on multicast messages, e.g., Generic Object Oriented Substation Event (GOOSE) and Sampled Measured Value (SMV), are incorporated in the proposed network-based anomaly detection. The proposed simultaneous intrusion detection method is able to identify the same type of attacks at multiple substations and their locations. The result is a new integrated tool for detection and mitigation of cyber intrusions at a single substation or multiple substations of a power grid.

Spotlight

Shavlik

Shavlik, a global leader in simplifying the complexity of IT management, is dedicated to significantly reducing the time-to-value for IT professionals from months to minutes. Shavlik’s Protect, Configure, Patch for Microsoft SCCM (formally SCUPdates) and Management Intelligence are some of its on-premise and cloud base solutions that enable customers to manage both physical and virtual machines, deploy software, discover assets, simplify configuration, control power usage and ensure endpoint security. By bringing the sophisticated capabilities enjoyed by large companies to organizations of all sizes and types, Shavlik is driving the democratization of IT.

OTHER WHITEPAPERS

The Veritas Ransomware Resiliency Strategy

whitePaper | January 19, 2023

The threat of ransomware attacks is a top concern for businesses of all types and sizes. Ransomware attacks have become commonplace with cybercriminals continuously evolving and creating new, more sophisticated ways to deliver attacks. With demands becoming excessive and the risk of data loss increasing, an advanced multi-layered resiliency strategy is needed to help ensure that your IT services are secure, resilient, and recoverable while providing the smooth user experience that your end users expect.

The State of Mobile App Security 2022

whitePaper | July 28, 2022

Mobile apps have become key tools for businesses to serve customers, earn revenue, and enable remote work by employees. Over the last two years, mobile apps have become critical to success for the majority of businesses.

Cybersecurity in the Cloud White Paper

whitePaper | July 1, 2023

Cloud services have changed the face of business, offering scalability, efficiency and cost savings not available with onpremises IT infrastructure. The cloud makes it easier for organizations to manage the ever-increasing amount of data passing through their systems, helping teams communicate and collaborate across different locations. By enhancing the ability to access and manage information, the cloud has introduced a new way of approaching productivity and security – and has transformed how we work.

Analyzing the Economic and Operational Benefits of theDell Data Protection Portfolio

whitePaper | November 29, 2022

We live in an intensely data-driven world, where data loss is unacceptable and quick access to information with real-time analytics driven by machine learning and artificial intelligence is at the core of decision making. Effective data protection is a critical component of every successful business. Now, more than ever, organizations are looking at their data protection strategies through a new lens. They are evaluating old practices, with a focus on making data protection a hands-off, efficient solution they can rely on without applying extensive IT resources. This can be accomplished through standardizing on a vendor with a comprehensive data protection offering, single management capabilities, and support across a diverse network of systems on-premises, in public and private data centers, in multiple clouds, and in remote office/branch offices (ROBO) and edge environments.

Adobe Acrobat with Document Cloud Services Security Overview

whitePaper | October 26, 2022

At Adobe®, we know the security of your digital experiences is important. Security practices are deeply ingrained into our internal software development and operations processes and tools and are rigorously followed by our cross-functional teams to prevent, detect, and respond to incidents in an expedient manner.

Best Practices for Row Level Security in Tableau with Entitlements Tables

whitePaper | January 18, 2023

Row Level Security (RLS) in Tableau refers to restricting the rows of data a certain user can see in a given workbook or data source at the time they view the data. It contrasts with permissions within Tableau Server (or Tableau Online), which are used to control access to content and feature functionality.

Integrated Anomaly Detection for Cyber Security of the Substations