DNP3 over TCP/IP 환경 전력 제어시스템에서의 상태추정 기반 침입 탐지 연구
A Study on State Estimation Based Intrusion Detection in Power Control Systems Using DNP3 over TCP/IP
2
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
전력계통의 변화 및 IT 기술 발전 등에 따라 통신 방식 변경에 대한 요구가 커지고 있어 시리얼 기반 통신에서 TCP/IP 기반 통신으로의 변경은 불가피하다. 하지만 TCP/IP 기반 통신의 경우 보다 다양한 보안 위협이 존재하기 때문에 정보보안 측면에서 많은 고려가 필요하다. 인증 및 암호화 등의 보안대책은 원격소 장치(RTU : Remote Terminal Unit)의 교체, 암호 알고리즘의 성능 요건 충족 등의 문제로 단기간에 적용은 불가능하다. 본 논문에서는 이러한 상황 속에서 전력 제어시스템으로의 위협을 식별하고 효과적으로 탐지하기 위해 상태추정 기반의 침입 탐지 모델을 제안하였다. 제안된 모델은 시그니처 탐지 방식에 더해 취득 데이터의 유효성을 검증함으로써 데이터 위변조 등 기존의 방법으로 탐지하기 어려운 공격들을 탐지할 수 있었다.
Abstract
With the evolution of power systems and advancements in IT technology, there is an increasing demand to shift from serial-based communication to TCP/IP-based communication. However, TCP/IP communication entails various security threats, necessitating extensive consideration from an information security perspective. Security measures such as authentication and encryption cannot be rapidly implemented due to issues like the replacement of Remote Terminal Units (RTUs) and the performance requirements of encryption algorithms. This paper proposes a state estimation-based intrusion detection model to identify and effectively detect threats to power control systems in such a context. The proposed model, in addition to signature detection methods, verifies the validity of acquired data, enabling it to detect attacks that are difficult to identify using traditional methods, such as data tampering.
참고문헌 (26)
- "Cyber Threats and Security Strategies in the Intelligence of Power Grids"[URL]
- "Cyber-Attack Against Ukrainian Critical Infrastructure"[URL]
- "WIN32/INDUSTROYER: A new threat for industrial control systems"[URL]
- J. Beerman, "A Review of Colonial Pipeline Ransomware Attack", 2023IEEE, 2023, 8~15
- The 10th Basic Plan for Long-term Electricity Supply and Demand (2022-2036), "Ministry of Trade, Industry and Energy", ~ (2023)
- Korea Power Exchange, "Electricity Market Operation Regulations", ~ (2024)
- Moon-su Jang, "Testing Vulnerabilities of DNP3", Journal of Security Engineering, 7(1), pp.15~28 (2010)
- Pauline Koh, "Intrusion Detection Methodology for SCADA system environment based on traffic self-similarity property", Journal of The Korea Institute of Information Security & Cryptology, 22(2), pp.267~281 (2012)
- Jeong-han Yun, "Burst-based Anomaly Detection on the DNP3 Protocol", International Journal of Control and Automation, 6(2), pp.313~324 (2013)
- Sung-moon Kwon, "DNP3 Protocol Security and Attack Detection Method", Journal of Advanced Navigation Technology, 18(4), pp.353~358 (2014)
- Myung-jong Kim, "WhiteList-based DNP3 Intrusion Detection System for SCADA", Proceedings of the Korea Information Processing Society Conference, pp.228~231 (2016)
- E. Michael, "Comparison of approaches for intrusion detection in substations using the IEC 60870-5-104 protocol", Energy Informatics, 3(S1), pp.1~17 (2020)
- W. Patrick, "Man-in-the-middle attacks and defence in a power system cyber-physical testbed", IET Cyber-Physical Systems, 6(3), pp.164~177 (2021)
- M. Altaha, "Anomaly Detection for SCADA System Security Based on Unsupervised Learning and Function Codes Analysis in the DNP3Protocol", Electronics, 11(14) (2022)
- V. Kelli, "Attacking and Defending DNP3 ICS", SCADA Systems, 2022 (2022), 183~190
- Hee-yong Kwon, "Advanced Intrusion Detection Combining Signature-Based and Behavior-Based Detection Methods", Electronics, 11(6) (2022)
- "Overview of DNP3Protocol"[URL]
- DNP Users Group, "A DNP3 Protocol Primer", ~ (2005)
- DNP Users Group, "DNP3SPECIFICATION, Volume 1", ~ (2002)
- "Quickdraw-Snort DNP3Rules"[URL]
- Hyo-sang Lee, "A Study of SCADA Function Specific Design in Korean EMS", Proceedings of the KIEE Conference, pp.402~403 (2007)
- Tae-young Song, "Application and Experience of State Estimation in Korea Power System", Proceedings of the KIEE Conference, pp.89~91 (2003)
- Young-in Kim, "Data acquisition Status Check Method for Power System Analysis", Proceedings of the KIEE Conference, pp.233~234 (2015)
- Hyung-koo Kang, "The Utilization Evolution of EMS Network Analysis for Optimal Power System Operation", Proceedings of the KIEE Conference, pp.20~21 (2009)
- Yoon-seong Cho, "Validation Methodology of Network Analysis Applications in the K-EMS", Proceedings of the KIEE Conference, pp.142~143 (2010)
- Yeon-jae Kang, "Intrusion Detection System Based on Sequential Model in SOME", IP, 2022, pp.32(6), 1171~1181