智能电网中CPS设备受损的系统级行为检测框架
A System-level Behavioral Detection Framework for Compromised CPS Devices: Smart-Grid Case
摘要：
网络物理系统（CPS）在我们从配电到公用事业网络的关键基础设施网络中发挥着重要作用。新兴的智能电网概念是一种引人注目的关键CPS基础设施，它依赖于智能设备之间的双向通信来提高效率，增强可靠性并降低成本。然而，智能电网中的受损设备带来了一些安全挑战。通过受损设备传播虚假数据或窃取敏感的智能电网信息的后果是昂贵的。因此，受损设备的早期行为检测对于保护智能电网的组件和数据至关重要。为了解决这些问题，在本文中，我们介绍了一种新的和可配置的系统级框架，以识别受损的智能电网设备。该框架将系统和函数调用跟踪技术与信号处理和统计分析相结合，以根据受损设备的行为特征检测受损设备。我们衡量我们的框架的有效性与现实的智能电网变电站测试平台，包括资源有限和资源丰富的设备。总之，使用我们的框架，我们分析了六种不同类型的受损设备的情况下，不同的资源和攻击有效载荷。据我们所知，该框架是第一个在检测受损CPS智能电网设备与系统和功能级调用跟踪技术。实验结果表明，一个优秀的率受损设备的检测。具体而言，性能指标包括不同攻击场景的95%到99%之间的准确度值。最后，性能分析表明，所提出的框架的使用具有最小的开销对智能电网设备的计算资源。
英文摘要：
Cyber-Physical Systems (CPS) play a significant role in our critical infrastructure networks from power-distribution to utility networks. The emerging smart-grid concept is a compelling critical CPS infrastructure that relies on two-way communications between smart devices to increase efficiency, enhance reliability, and reduce costs. However, compromised devices in the smart grid poses several security challenges. Consequences of propagating fake data or stealing sensitive smart grid information via compromised devices are costly. Hence, early behavioral detection of compromised devices is critical for protecting the smart grid's components and data. To address these concerns, in this paper, we introduce a novel and configurable system-level framework to identify compromised smart grid devices. The framework combines system and function call tracing techniques with signal processing and statistical analysis to detect compromised devices based on their behavioral characteristics. We measure the efficacy of our framework with a realistic smart grid substation testbed that includes both resource-limited and resource-rich devices. In total, using our framework, we analyze six different types of compromised device scenarios with different resources and attack payloads. To the best of our knowledge, the proposed framework is the first in detecting compromised CPS smart grid devices with system and function-level call tracing techniques. The experimental results reveal an excellent rate for the detection of compromised devices. Specifically, performance metrics include accuracy values between 95% and 99% for the different attack scenarios. Finally, the performance analysis demonstrates that the use of the proposed framework has minimal overhead on the smart grid devices' computing resources.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
