Biblio

Power systems become a primary target of cyber attacks because of the vulnerability of the integrated communication networks. An attacker is able to manipulate the integrity of real-time data by maliciously modifying the readings of meters transmitted to the control center. Moreover, it is demonstrated that such attack can escape the bad data detection in state estimation if the topology and network information of the entire power grid is known to the attacker. In this paper, we propose an isolation forest (IF) based detection algorithm as a countermeasure against false data attack (FDA). This method requires no tedious pre-training procedure to obtain the labels of outliers. In addition, comparing with other algorithms, the IF based detection method can find the outliers quickly. The performance of the proposed detection method is verified using the simulation results on the IEEE 118-bus system.

The supervisory control and data acquisition (SCADA) network in a smart grid requires to be reliable and efficient to transmit real-time data to the controller. Introducing SDN into a SCADA network helps in deploying novel grid control operations, as well as, their management. As the overall network cannot be transformed to have only SDN-enabled devices overnight because of budget constraints, a systematic deployment methodology is needed. In this work, we present a framework, named SDNSynth, that can design a hybrid network consisting of both legacy forwarding devices and programmable SDN-enabled switches. The design satisfies the resiliency requirements of the SCADA network, which are specified with respect to a set of identified threat vectors. The deployment plan primarily includes the best placements of the SDN-enabled switches. The plan may include one or more links to be installed newly. We model and implement the SDNSynth framework that includes the satisfaction of several requirements and constraints involved in resilient operation of the SCADA. It uses satisfiability modulo theories (SMT) for encoding the synthesis model and solving it. We demonstrate SDNSynth on a case study and evaluate its performance on different synthetic SCADA systems.

Over the last years, the maritime sector has seen an important increase in digital systems on board. Whether used for platform management, navigation, logistics or office tasks, a modern ship can be seen as a fully featured, complex and moving information system. Meanwhile, cyber threats on the sector are real and, for instance, the year 2018 has seen a number of harmful public ransomware attacks impacting shore and ashore assets. Gaining cyber situation recognition, comprehension and projection through Maritime Cyber Situational Awareness is therefore a challenging but essential task for the sector. However, its elaboration has to face a number of issues, such as the collect and fusion of real-time data coming from the ships and an efficient visualization and situation sharing across maritime actors. In this paper, we describe our current work and results for maritime cyber situational awareness elaboration. Even if its development is still going on, the first operational feedback is very encouraging.