| Title | On Holistic Multi-Step Cyberattack Detection via a Graph-based Correlation Approach |
| Publication Type | Conference Paper |
| Year of Publication | 2022 |
| Authors | Sen, Ömer, Eze, Chijioke, Ulbig, Andreas, Monti, Antonello |
| Conference Name | 2022 IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SmartGridComm) |
| Date Published | oct |
| Keywords | composability, Correlation, Cyber Intelligence Database, cyber security, Data models, Graph-based Correlation, information and communication technology, Intrusion detection, knowledge based systems, Power measurement, Predictive Metrics, pubcrawl, Resiliency, Smart grid, Smart Grid Situational Awareness, Smart grids, Technological innovation |
| Abstract | While digitization of distribution grids through information and communications technology brings numerous benefits, it also increases the grid's vulnerability to serious cyber attacks. Unlike conventional systems, attacks on many industrial control systems such as power grids often occur in multiple stages, with the attacker taking several steps at once to achieve its goal. Detection mechanisms with situational awareness are needed to detect orchestrated attack steps as part of a coherent attack campaign. To provide a foundation for detection and prevention of such attacks, this paper addresses the detection of multi-stage cyber attacks with the aid of a graph-based cyber intelligence database and alert correlation approach. Specifically, we propose an approach to detect multi-stage attacks by lever-aging heterogeneous data to form a knowledge base and employ a model-based correlation approach on the generated alerts to identify multi-stage cyber attack sequences taking place in the network. We investigate the detection quality of the proposed approach by using a case study of a multi-stage cyber attack campaign in a future-orientated power grid pilot. |
| DOI | 10.1109/SmartGridComm52983.2022.9961016 |
| Citation Key | sen_holistic_2022 |
On Holistic Multi-Step Cyberattack Detection via a Graph-based Correlation Approach