Early Attack Detection for Securing GOOSE Network Traffic

Ghada Elbez

doi:10.1109/TSG.2023.3272749

Early Attack Detection for Securing GOOSE Network Traffic

2024-01-01

4

OA

AI

DOI：10.1109/TSG.2023.3272749

原文链接

原文求助

摘要

En 中文

The requirements for the security of the network communication in critical infrastructures have been more focused on the availability of the data rather than the integrity and the confidentiality. The availability of communication in IEC 61850 substations can be hindered by Generic Object Oriented Substation Event (GOOSE) poisoning attacks that might result in threats such as Denial of Service (DoS) or flooding attacks. In order to accurately detect similar attacks, a novel method for the Early Detection of Attacks for GOOSE Network Traffic (EDA4GNeT) is developed in the present work. The EDA4GNeT method considers the dynamic behavior of network traffic in electrical substations. A mathematical modeling of GOOSE network traffic is adopted for the anomaly detection based on statistical hypothesis testing. The developed mathematical model of the communication traffic can also support the management of the network architecture in IEC 61850 substations based on appropriate performance studies. To test the novel anomaly detection method and compare the obtained results with related works found in the literature, a simulation of a DoS attack against a ${66/11}{\mathrm{ kV}}$ substation with several experiments is used as a case study.

Keyword:

Substations

IEC Standards

Anomaly detection

Security

Telecommunication traffic

Mathematical models

Smart grids

communication network

cyber-security

electrical substations

GOOSE

IDS

IEC 61850

IEC 62351

Early Attack Detection for Securing GOOSE Network Traffic

摘要

期刊

机构