IED Network Traffic Monitoring for Power System Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intelligent electronic devices (IEDs) in electric power delivery systems are vulnerable to security attacks and configuration changes, leading to faults and failures, necessitating effective monitoring techniques to identify security attacks and predict/prevent such issues.
Innovation Solution
A monitoring system using intelligent electronic devices (IEDs) to monitor network traffic by analyzing communication parameters against predefined thresholds and employing machine learning to detect anomalies, generating notifications, and integrating with a central monitoring system for real-time assessment and response.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IEDs are deployed to monitor network traffic, then security attacks and faults can be identified, but the system becomes more complex and vulnerable to attacks
Solution Approach 1:
The patent introduces a separate monitoring system that acts as an intermediary between the IEDs and the central control system. This monitoring system captures network traffic independently and performs analysis, preventing the IEDs from being directly involved in complex monitoring operations. The intermediary monitoring system reduces the complexity burden on individual IEDs while maintaining comprehensive fault detection capability.
Solution Approach 2:
The monitoring system creates copies of network traffic data for analysis without requiring the original IEDs to perform complex monitoring functions. By copying and analyzing traffic data separately, the system achieves comprehensive monitoring capability while keeping the original IEDs relatively simple and focused on their primary control functions.
2Measurement precision
If comprehensive network traffic monitoring is implemented, then security attacks can be detected, but processing time and computational resources increase
Solution Approach 1:
The monitoring system applies partial action by focusing on detecting specific abnormal patterns and threshold violations rather than analyzing every single packet in detail. The system uses predefined thresholds and anomaly detection algorithms to identify only the most significant deviations from normal behavior, achieving effective attack detection without the computational overhead of comprehensive deep packet inspection.
Solution Approach 2:
The system performs preliminary action by establishing baseline normal behavior patterns and predefined thresholds before actual monitoring begins. This allows the monitoring system to quickly compare incoming traffic against known good patterns and immediately identify deviations, significantly reducing processing time compared to analyzing each packet without pre-established criteria.
3Speed
If real-time monitoring notifications are implemented, then timely intervention is enabled, but false alarms may increase system noise
Solution Approach 1:
The monitoring system implements feedback mechanisms where detection results are continuously evaluated and adjusted based on system responses and subsequent traffic patterns. When potential anomalies are detected, the system monitors whether they persist or resolve, allowing operators to refine threshold settings and reduce false alarms over time while maintaining rapid response capability for genuine threats.
Data Source
AI summary
Systems and methods may be used to assess network communications by generating one or more current communication parameters based on communications at an intelligent electronic device (IED) within an electric power delivery system. Network communications may be assessed by determining, at the IED, whether the communications fall within one or more thresholds for the current communication parameters.