CPL - Chalmers Publication Library
| Utbildning | Forskning | Styrkeområden | Om Chalmers | In English In English Ej inloggad.

METIS: a Two-Tier Intrusion Detection System for Advanced Metering Infrastructures

Vincenzo Gulisano (Institutionen för data- och informationsteknik, Nätverk och system, Datakommunikation och distribuerade system (Chalmers)) ; Magnus Almgren (Institutionen för data- och informationsteknik, Nätverk och system (Chalmers) ) ; Marina Papatriantafilou (Institutionen för data- och informationsteknik, Nätverk och system (Chalmers) )
10th International Conference on Security and Privacy in Communication Networks (SecureComm) (1867-8211). Vol. 153 (2014), p. 51-68.
[Konferensbidrag, refereegranskat]

In the shift from traditional to cyber-physical electric grids, motivated by the needs for improved energy efficiency, Advanced Metering Infrastructures have a key role. However, together with the enabled possibilities, they imply an increased threat surface on the systems. Challenging aspects such as scalable traffic analysis, timely detection of malicious activity and intuitive ways of specifying detection mechanisms for possible adversary goals are among the core problems in this domain. Aiming at addressing the above, we present METIS, a two-tier streaming-based intrusion detection framework. METIS relies on probabilistic models for detection and is designed to detect challenging attacks in which adversaries aim at being unnoticed. Thanks to its two-tier architecture, it eases the modeling of possible adversary goals and allows for a fully distributed and parallel traffic analysis through the data streaming processing paradigm. At the same time, it allows for complementary intrusion detection systems to be integrated in the framework. We demonstrate METIS’ use and functionality through an energy exfiltration use-case, in which an adversary aims at stealing energy information from AMI users. Based on a prototype implementation using the Storm Stream Processing Engine and a very large dataset from a real-world AMI, we show that METIS is not only able to detect such attacks, but that it can also handle large volumes of data even when run on commodity hardware.

Nyckelord: Advanced metering infrastructures, Data streaming, Intrusion Detection systems

Denna post skapades 2014-12-08. Senast ändrad 2016-08-12.
CPL Pubid: 207632


Läs direkt!

Länk till annan sajt (kan kräva inloggning)