Anomaly Detection in Smart Grids based on Software Deﬁned Networks

Oliver Jung, Paul Smith, Julian Magin and Lenhard Reuter

Center for Digital Safety and Security, Austrian Institute of Technology, Vienna, Austria

Keywords:

Smart Grid, Software Deﬁned Networks, Network Security, Anomaly Detection, Information Theory.

Abstract:

Software-deﬁned networking (SDN) is a networking architecture that increasingly receives attention from

power grid operators. The basic principle is the separation of the packet forwarding data plane and the central

controller implemented in software that provides a programmable network control plane. SDN can provide

various functions that facilitate the operation of smart grid communication networks, as it can support network

management, quality of service (QoS) enforcement, network security, and network slicing. Due to periodical

updates of the central controller, a real-time view of the network is available that allows for detecting attacks

like e.g. denial-of-service (DoS) attack or network scanning. These kinds of attacks can be detected by

applying anomaly detection mechanisms on the gathered information. In this position paper, we highlight

the beneﬁts SDN can bring to smart grids, address the implications of SDN on network security, and ﬁnally

describe how information collected by a popular OpenFlow SDN controller can be used to detect attacks in

smart grid communication networks.

1 INTRODUCTION

The power grid is currently subject to signiﬁcant

changes. It has to cope with an growing num-

ber of decentralized generation, an increasing num-

ber of electric vehicles, new business models like

virtual power plants and local energy communities

(MENDES et al., 2018) and the demand for energy-

and cost-efﬁcient system operation. Some of these

challenges can only be coped with by introducing

information and communication technology into all

parts of the power grid to build the smart grid. The

smart grid communication network thus has to sup-

port all different kinds of applications coming with

speciﬁc requirements for e.g. quality of service (QoS)

and Security.

To handle all these requirements grid operators

originally introduced Multi Protocol Label Switching

(MPLS) into their communication networks. How-

ever, due to the essential beneﬁts provided that

software-deﬁned networking (SDN) for communica-

tion in smart grids they are currently considering to

replace MPLS by SDN or to build an SDN overlay on

top of MPLS.

SDN can provide features like network segmen-

tation, fast failover, network monitoring required for

smart grid communication infrastructures. The cen-

tralized SDN controller has a complete overview of

the communication network status and thus monitor-

ing can be be signiﬁcantly simpliﬁed. This is not only

important for identifying problems in smart grid net-

work equipment, such as switches and routers, but

also for security reasons. Gathered network trafﬁc in-

formation are well suited for applying anomaly de-

tection to identify different kinds of network mis-

behaviour. Operators are thus enabled to detect

malfunctioning or misconﬁgured power grid devices,

such as intelligent electronic devices (IED) or remote

terminal units (RTU) and to detect malicious attacks.

The central SDN controller collects trafﬁc ﬂow in-

formation from all switches connected and thus has

complete visibility of the network. It has been shown

that anomaly detection can be successfully applied to

trafﬁc ﬂows in order to identify different kinds of at-

tack that can severely degrade smart grid availability.

This position paper addresses the beneﬁts that

software deﬁned networking can offer to smart grid

communication networks, in particular focusing on

improved attack identiﬁcation capabilities, by apply-

ing network-based anomaly detection to SDN ﬂow in-

formation.

This paper is organized as follows. Section 2 will

introduce related work. Section 3 deals with commu-

nication networks for smart grids while Section 4 ad-

dresses basic SDN functionalities, related security is-

sues and the pros and cons for introducing SDN in

Jung, O., Smith, P., Magin, J. and Reuter, L.

Anomaly Detection in Smart Grids based on Software Deﬁned Networks.

DOI: 10.5220/0007752501570164

In Proceedings of the 8th International Conference on Smart Cities and Green ICT Systems (SMARTGREENS 2019), pages 157-164

ISBN: 978-989-758-373-5

157

smart grids. Section 5 describes how anomaly detec-

tion can actually be done in SDN and how our ap-

proach will be validated. Finally, Section 6 concludes

our paper.

Table 1: List of acronyms.

DDOS Distributed denial-of-service

DOS Denial-of-service

DS Differentiated service

HAN Home Area Network

ICMP Internet Control Message Protocol

IED Intelligent Electronic Device

MPLS Multiprotocol Label Switching

NAN Neighborhood Area Network

ONOS Open Network Operating System

PCA Principal Component Analysis

QoS Quality of Service

RTU Remote Terminal Unit

SCADA

Supervisory Control and

Data Acquisition

SDECN

Software-deﬁned Energy

Communication Network

SDN Software-deﬁned Networking

VLAN Virtual Local Area Network

WAN Wide Area Network

2 RELATED WORK

Software-deﬁned networking (SDN) for smart grid

communication has not only attracted attention from

the research community but recently also from prac-

titioners. One of the ﬁrst analyses of this issue can

be found in (Zhang et al., 2013). They highlight the

SDN capabilities that make it ideally suited for the

smart grid: a) ease of conﬁguration and management,

b) cross domain content-based networking, and c) vir-

tualisation and isolation. They present three use cases

to underline their position.

In (Cahn et al., 2013) the authors describe how

communication within an electric substation can be

improved. One of the challenges of conventional sub-

station networks is the complex conﬁguration of mul-

ticast groups for more than a hundred IEDs. The

suggested software-deﬁned energy communication

network (SDECN) architecture can eliminate many

substation network management issues by providing

auto-conﬁguration capabilities.

The authors of (Aydeger et al., 2016) explored

how an SDN-enabled smart grid infrastructure can

improve substations resilience with self-recovery by

considering wireless communication links as failover

solution. The approach was evaluated using a virtual

Mininet-based test bed with the ns-3 network simula-

tor.

It generally has been acknowledged that there are

quite some security related issues around SDN. On

one hand side, SDN can provide functionalities for

improving network security by improved network vis-

ibility and ease of re-conﬁguration. On the other

hand, the controller constitutes a single point of fail-

ure that increases the attack surface due to complex-

ity. The pros and cons around SDN security have been

summarized by (Dacier et al., 2017).

An approach for improving smart grid resilience

through SDN is presented in (Dong et al., 2015). The

solution establishes communication links only when

grid control commands are sent from the control cen-

tre to the grid devices. By doing so, the attacker has

only limited time to inject bogus control commands.

Using trafﬁc ﬂow information for network moni-

toring is a recognized key beneﬁt of SDN. However,

anomaly detection in SDN has gained only limited

attention. In (Braga et al., 2010) the authors sug-

gest to use an artiﬁcial neural network method for

DDoS attack detection based on SDN trafﬁc ﬂow fea-

tures. Authors of (Mehdi et al., 2011) apply differ-

ent anomaly detection mechanisms in an SDN. They

evaluate the probability of successful connection at-

tempts and use maximum entropy estimation of traf-

ﬁc features. However, the latter approach requires the

examination of every packet and thus dismisses the

beneﬁts of SDN to some extent.

A comparison of OpenFlow and sFlow concern-

ing ﬂow retrieval for anomaly detection is provided

by (Giotis et al., 2014). They claim that the number of

ﬂow table entries may grow in a way that it can impact

the switching performance, in particular, in the case

of DoS attacks. Thus, sFlow with sampling for data

collection is used for detection purposes while Open-

Flow is responsible for attack mitigation by dropping

attack trafﬁc.

Trafﬁc features are mostly analysed separately in

order to detect anomalies. To allow for anomaly de-

tection across multiple trafﬁc features or ﬂows, au-

thors in (Lakhina et al., 2005) apply the multiway sub-

space method after an initial entropy-based analysis.

In this paper, we propose to apply entropy-based

anomaly detection to ﬂow data that is collected by an

OpenFlow controller in a smart grid. We expect to

gain even better results as smart grid trafﬁc is assumed

to be uniformly distributed given that most data pack-

ets from sensor measurements are sent periodically

and control commands are rather scarce under normal

conditions.

SMARTGREENS 2019 - 8th International Conference on Smart Cities and Green ICT Systems

158

3 SMART GRID

COMMUNICATION

Smart Grids are a set of technologies that are used

for remote control, monitoring, automation and digi-

talization of electrical power systems, including elec-

tricity distribution, demand and supply.

The electrical distribution grid is expected to ac-

commodate more smart loads (e.g. controllable loads)

and distributed energy generation devices, such as PV

inverters, in the near future. Connecting more devices

requires the communication network to be easily scal-

able, manageable and secure.

In general the aim of smart grid implementations

is to optimize failure handling, grid control, costs,

supply and demand, and increase the share of elec-

tricity from renewable energy sources. In order to

meet these objectives, the communication infrastruc-

ture has to support extensive network monitoring to

detect failures before they severely impact grid con-

trol, and maintain a high level of security and depend-

ability.

Thus, utilities introduce Multi Protocol Label

Switching (MPLS) in their communication back-

bones. The main reasons for this are the provisioning

of virtual private networks and the trafﬁc engineer-

ing capabilities. However, MPLS is not very ﬂexible

when it comes to new network services (Sydney et al.,

2013).

In contrast, the programmable controller in soft-

ware deﬁned networks allows for the easy deploy-

ment of new network services, even during runtime.

In SDN, different classes of smart grid network trafﬁc

can be isolated, e.g. to guarantee QoS. The software-

based network control applications allow for arbitrary

changes of switching devices. They add an additional

layer of control over network trafﬁc as it allows to

prioritize or permit/block certain packet ﬂows. SDN

may thus outperform MPLS as a backbone communi-

cation technology.

The emergence of digital communication net-

works has also added to the evolution of Supervi-

sory Control and Data Acquisition (SCADA) systems

that are essential for power system network opera-

tion. Currently, a number of open international stan-

dards exist in the SCADA systems of utilities, such as

the IEC 60870–5 and IEC 61850 series. While IEC

61850 is predominantly applied to intra-substation

communication, IEC 60870–5-104 is used for tele-

control between control centres and substations (Yang

et al., 2013).

The smart grid is expected to support a number of

different functionalities that come with their speciﬁc

performance requirements for the communication in-

frastructure. This infrastructure has to connect a vast

number of geographically spread devices, such as

Remote Terminal Units (RTUs) in substations, con-

trollers of distributed energy resources, as well as

bulk generation. In general, three categories of com-

munication networks can be distinguished: Home

Area Networks (HANs), Neighborhood Area Net-

works (NANs) and Wide Area Networks (WANs)

(Kuzlu et al., 2014).

Wide area networks connect distributed NANs

and HANs in different geographic locations. Real-

time measurements from devices are transported from

the substations to control centres through the wide

area networks. Control messages are sent by the con-

trol centre to the substations using the WAN. For

wide-area situational awareness, utilities require a

lot of time-stamped and real-time measurement data

from sensors in the power grid for monitoring, con-

trol, and protection (Wang et al., 2011). Thus, the

WAN in the smart grid system should provide reliably

high bandwidth and low latency.

Neighborhood Area Networks connect sensors on

the distribution feeders and transformers, and IEDs

carrying out control commands, distributed energy re-

sources in the distribution grid, or smart meters at

customer premises (Wang et al., 2011). These de-

vices build the main source of information for the

control centres to estimate the state of the distribu-

tion grid, and they are controlled by the control cen-

tre. The main requirement for applications in the cus-

tomer premises, such as smart metering, is scalabil-

ity. These applications are usually not sensitive to low

bandwidth or high latency. In contrast applications in

the ﬁeld like e.g. SCADA for grid control require low

latency and high reliability. Operators should thus be

able to provide separated QoS classes to the different

categories of applications using e.g. network slicing

or virtualization, as provided by SDN.

Home area networks connect devices in the cus-

tomer premises to support applications such as de-

mand response or advanced metering. The HAN is

usually not under the control of the utility. Commu-

nication with devices in the HAN is done via a home

gateway or with the smart meter directly. The number

of devices connected to the HAN is limited and there

are no strict communication requirements compared

to WAN and NAN.

4 SOFTWARE DEFINED

NETWORKS

SDN is a network architecture where conﬁguration

and intelligence are provided by an SDN controller.

Anomaly Detection in Smart Grids based on Software Deﬁned Networks

159

The separated data plane is a mere packet forwarding

layer, implementing rules that are deﬁned by a con-

troller. The SDN controller enables programmability

of network conﬁguration using protocols like Open-

Flow (Open Networking Foundation, 2012) to con-

trol ﬂow tables that are maintained by switches and

routers in the network. By relocating control func-

tionalities to a software-based controller, SDN can

provide a high degree of ﬂexibility for implementing

new networking solutions for Smart Grids.

Network switches and routers usually have packet

routing and control algorithms included in the de-

vice ﬁrmware. However, the ﬁrmware is often not

accessible with the consequence that the switch’s

functionality cannot be changed easily. In contrast,

a software-based controller with numerous existing

open-source implementations, such as OpenDaylight

(Medved et al., 2014) or ONOS (Berde et al., 2014),

can be changed and new functionality added.

Figure 1 shows the basic SDN concept and archi-

tecture. The southbound interface deﬁnes the instruc-

tion set of the forwarding devices or switches. Al-

though there are other proprietary protocols, Open-

Flow (Open Networking Foundation, 2012) is the

most popular communication protocol to conﬁg-

ure forwarding devices from the control plane. It

is supported by numerous commercial-of-the-shelf

switches.

The northbound interface is the API for network

applications, denoted as App in Figure 1. Actual net-

work control and operation is implemented in the net-

work applications. They provide essential network

services such as switching, routing, ﬁrewalls, load

balancing or intrusion prevention. They interact with

the data plane without having the need of dealing with

each individual switch.

Control Plane

Data Plane

Openflow Switch

Meter

Table

Group

Table

Flow

Table

Flow

Table

Openflow Switches

Southbound Interface

Norththbound Interface

Application

Plane

App App App App

SDN Controller

Openflow Protocol

Data Transfer

Figure 1: OpenFlow SDN conceptual architecture.

The OpenFlow switch maintains different tables.

The most important ones are the ﬂow tables. They

deﬁne how packets are processed by the switch. The

table consists of three parts: (i) match ﬁelds such

as ingress port, destination and source IP address, or

ICMP type for matching received packets; (ii) instruc-

tions that are executed for matched packets, like for-

warding or dropping packets; (iii) and statistics re-

garding the matched packets. When a new packet is

received, which has no matching entry in the ﬂow ta-

ble, it is forwarded to the controller for further pro-

cessing. The controller processes the packet and pre-

pares the ﬂow entry that is implemented by the switch.

Group tables are a way to support more complex

tasks that are not possible using ﬂow table instruc-

tions. Using groups, complex actions or sets of ac-

tions can be executed. Each group can contain sepa-

rate lists of actions, called OpenFlow buckets.

The meter tables contain per ﬂow meter entries

with the purpose of implementing QoS operations.

They are used to monitor and control the rate of as-

sociated ﬂows and can apply drop actions or change

the differentiated services (DS) ﬁeld of the IP packet.

4.1 SDN in Smart Grids

The main beneﬁt of SDN in smart grids is the capabil-

ity to dynamically conﬁgure network devices by ma-

nipulating data trafﬁc ﬂows, in order to improve QoS

or system resilience by preventing and mitigating fail-

ures and attacks (Dong et al., 2015). In general, the

key advantages of applying SDN in smart grids in-

clude (Rehmani et al., 2018):

• Isolation of trafﬁc classes and applications: As

described in Section 3, smart grid communi-

cation networks are divided into different cate-

gories, supporting applications with different de-

mands concerning bandwidth, latency and relia-

bility. SDN can establish virtual networks in order

isolate applications (Kim et al., 2014).

• QoS enforcement: SDN introduces QoS mecha-

nisms for giving higher priority to time critical

measurements from different devices and control

messages, e.g. from the control centre to the sub-

station by link reservation (Dorsch et al., 2014)

• Resilience: Resilience of smart grid communica-

tion networks can be increased by fast re-routing

and switchover from failing links. Mechanisms

provided by SDN introduce lower latency in case

of failover compared to classical routing mecha-

nisms, as SDN mechanisms respond faster to net-

work events (Dorsch et al., 2014).

SMARTGREENS 2019 - 8th International Conference on Smart Cities and Green ICT Systems

160

• Network Visibility: The central SDN controller

periodically requests status information from the

connected SDN switches. Thus, it has full visi-

bility of all ﬂows in the network and is aware of

the number of received packets and bytes, avail-

able bandwidth and links. Acquired ﬂow statis-

tics which provides a real-time view of the net-

work state is accessible via open APIs and thus a

convenient source of information for trafﬁc moni-

toring applications (Ali et al., 2015).

• Security: Link isolation is a requirement for smart

grid communication networks. IEC 62351-10 (In-

ternational Electrotechnical Commission, 2012)

deﬁnes security architecture guidelines for power

systems and requires the implementation of sepa-

rated security domains. Similarly, NIST IR 7628

(National Institute of Standards and Technology,

2014) asks for communications partitioning. Link

isolation can moreover be used to enforce access

control policies and to implement one-way com-

munication where messages can only be sent from

a trusted to an untrusted domain and not vice

versa.

Moreover, SDN trafﬁc routing features can be

used to block or redirect malicious trafﬁc origi-

nating from DoS attacks or a network scan.

SDN can thus bring numerous advantages to smart

grid communication networks. Utilities are currently

evaluating in ﬁeld trials the use of SDN in there pro-

cess networks. In the following section, some of se-

curity aspects of SDN deployments are highlighted.

4.2 SDN and Network Security

The SDN paradigm can bring opportunities to en-

hance security of smart grid communication net-

works, offering new approaches for preventing, de-

tecting and mitigating attacks. However, SDN also

increases the attack surface and existing standards do

not address issues of authentication and authorization.

The introduction of several network applications

can signiﬁcantly increases the system complexity

(Dacier et al., 2017), making it harder to identify

a speciﬁc application that is responsible for chang-

ing ﬂow entries in a particular way. The SDN APIs

can be used in order to implement elaborate security

applications. Acquiring network statistics, isolating

networks, leveraging active attack response is signiﬁ-

cantly simpliﬁed.

The drawback of the central controller is that acts

as a single point of failure, which potentially reduces

system resilience and is an attractive target for attack-

ers. Attackers who are able to compromise the con-

troller can gain full control over the network. Ad-

ditionally, the controller is susceptible to denial-of-

service-attacks using vast numbers of unknown ﬂows

and thus overloading the controller.

On the other hand, the centralized real-time situa-

tional awareness of the controller allows for detecting

DoS attacks more reliably and to mitigate attacks by

network re-conﬁguration, meaning that packets that

are identiﬁed as being part of an attack can be dropped

or redirected to a security appliance (Scott-Hayward

et al., 2016).

How data collection for security purposes can be

gathered is described in the following section, using

the OpenFlow SDN controller as an example.

4.3 Data Collection in OpenFlow

In order to gain situational awareness in the net-

work, the SDN controller performs regular requests

of ﬂow statistics from the OpenFlow-capable SDN

switches. In each request all ﬂow table entries and

included counter values are queried and downloaded

to the controller. The popular ONOS controller re-

quests by default every 5 seconds information about

active ﬂows using the OFPMP FLOW message with the

OFPTT ALL option. SDN controllers commonly pro-

vide a REST API that allows easy access to ﬂow en-

tries in general and to ﬂow statistics in particular. An

anomaly detection application can make use of this

API to interact with the controller.

The ﬂow table counters are updated for each

packet that corresponds to the match ﬁelds of the ﬂow

table. Match ﬁelds can include e.g. ingress port or

packet headers ﬁelds. Moreover, the ﬂow table holds

an action ﬁeld that deﬁnes how the matched packet

should be processed, e.g. forwarding to a speciﬁed

switch port, drop packet (empty instruction set), or

modify a virtual LAN (VLAN) tag. Thus, the Open-

Flow ﬂow statistics is closely related to packet for-

warding performed by the SDN switch. As a con-

sequence, the switches acquire full ﬂow information

compared to conventional packet forwarding devices

that aggregate packets into ﬂows and export ﬂow

data using protocols like sFlow, NetFlow, and IP-

FIX where often packet sampling is applied in or-

der to reduce effort for packet processing e.g. on

backbone routers. As the central SDN controller

is responsible for managing all the connected SDN

switches, it can acquire a complete overview of the

smart grid communication network knowing the ﬂows

of all switches.

Anomaly detection mechanisms can make use of

the counters that are included in the ﬂow table. The

OpenFlow Switch Speciﬁcation (Open Networking

Foundation, 2012) deﬁnes optional as well as manda-

Anomaly Detection in Smart Grids based on Software Deﬁned Networks

161

Switch

port

MAC

src

MAC

dst

VLAN

src

dst

TCP

srcp

TCP

dstp

...

Actions:

 Drop packet

 Forward the packet to a

particular port

 Modify packet state

 Forward the packet to

another table or group

for further processing

Match Fields

Priority

Counters

Instructions

Timeouts

 Received Packets

 Received Bytes

 Duration (seconds)

 Duration (nanoseconds)

...

Figure 2: OpenFlow ﬂow table.

tory per ﬂow packet and byte counters. A duration

counter maintains track of the time a ﬂow entry exists

in the ﬂow table. The structure of the ﬂow table is

shown in Figure 2.

The per ﬂow counters monitor the number of

packets since the ﬂow entry was installed in the ﬂow

table. For anomaly detection purposes, usually net-

work trafﬁc of a certain time interval is considered,

e.g. a 5 seconds interval. Thus, the anomaly detection

mechanism has to retain counter information until the

end of the following interval.

5 ANOMALY DETECTION

Flow data is widely used source of information for

detecting various types of security related incidents.

This includes malicious events such as distributed

denial-of-service (DDoS) attacks and network scans.

Compared to packet-based analyses, anomaly detec-

tion solely on ﬂow data usually results in more false

positives and negatives because of the lower resolu-

tion of ﬂow data.

Intrusion detection systems can be classiﬁed as

signature-based and anomaly-based detection sys-

tems. The former is only able to detect known attacks

by monitoring network trafﬁc for known byte patters

or trafﬁc sequences. This leads to low false positives,

incidents that are erroneously categorized as attacks,

but unknown attacks can not be detected. Anomaly-

based intrusion detection systems are able to detect

these kind of attacks by identifying deviations from

normal behaviour .

Most network trafﬁc anomalies have in common

that they change the distribution of IP packet header

ﬁelds like source and destination addresses and ports.

In the anomaly detection context these ﬁelds charac-

terising the trafﬁc behaviour are the trafﬁc features.

Obviously in case of the DoS, e.g. ﬂooding attack it

can be expected that the number of packets destined

to the victim will rise and thus change the trafﬁc fea-

ture distribution. Also a port scan will manifest in the

feature distribution where a single host scans various

destination IP addresses and ports from a single IP

address and port.

There are numerous approaches for ﬂow based

anomaly detection (Sperotto et al., 2010). We will fo-

cus on entropy based anomaly detection in the follow-

ing as an entropy based metric can effectively mea-

sure changes in the distribution of trafﬁc features over

time.

5.1 Entropy based Anomaly Detection

Entropy based anomaly detection approaches relying

on network feature distributions have been proven

successful for detecting different classes of attacks

like DoS and ports scans. They have been applied

in smart grid as well as in SDN environments (Giotis

et al., 2014; Lakhina et al., 2005).

We propose to use Shannon Entropy to detect

anomalies in the distribution of trafﬁc feature such as

source IP address, destination IP address, TCP source

port and TCP destination port. Entropy can be used as

a measure of the regularity of trafﬁc features (Lee and

Xiang, 2001). High entropy means a scattered fea-

ture distribution while low entropy values represent a

converged distribution.

A DoS attack, where vast numbers of packets are

destined to one destination IP address and destination

port will signiﬁcantly reduce entropy and can thus be

detected as a drop in entropy. A network scan where

whole network is scanned for existing IP addresses

and open ports will manifest in a rise in entropy.

Depending on the number of existing ﬂows, cal-

culating entropy values for each feature can generate

extensive data sets. Hence, in order to reduce the di-

mensionality of the data gathered Principal Compo-

nent Analysis (PCA) is used in a second step to re-

duce data dimensions. That is a procedure form mul-

tivariate statistics and consists of a linear regression

model. PCA can be considered as a pre-processing

step for the classiﬁcation phase. The aim is to set ap-

propriate counter measurements to prevent intrusions

and therefore provide more resilient network services

(Lakhina et al., 2005).

5.2 Testbed Validation

Figure 3 shows the testbed that will be used to ver-

ify that entropy based anomaly detection can be suc-

cessfully applied to SDN ﬂow information in a smart

grid communication network. We will integrate the

anomaly detection application in a power grid ICT in-

SMARTGREENS 2019 - 8th International Conference on Smart Cities and Green ICT Systems

162

frastructure which consists of a substation ring with

SDN switches. Grid status information will be re-

trieved from the substation RTU using Modbus TCP.

The SDN anomaly detection application is using

ﬂow information requested from the switches by the

ONOS controller using the controller’s REST API.

Flow statistics has to be requested by the controller

using OpenFlow OFPTT ALL request. In order to pre-

vent ﬂow entries to expire before they have been col-

lected by the controller the ﬂow timeout has to be ad-

justed to the request rate.

OpenFlow

Switch

SDN Controller

(ONOS)

Control Centre

RTU

OpenFlow

Switch

OpenFlow

Switch

SDN Applications

(Anomaly Detection)

REST API

Ethernet Data Plane

Ethernet Control Plane (flow monitoring)

OpenFlow statistics

Figure 3: Anomaly Detection testbed.

For generating smart grid trafﬁc we will use Rasp-

berry Pis with OpenMuc. OpenMuc is a framework

for implementing smart grid monitoring and control

applications and supports the most important smart

grid communication protocols (e.g. IEC 61850, IEC

60870-5-104, or Modbus). We will launch different

kinds of attacks such as DoS, network scans, port

scans against the smart grid nodes, and will mimic

attacker activities through irregular activities like un-

planned ﬁrmware updates and unusual connection at-

tempts. The metrics for evaluating efﬁciency of the

detection mechanism will be the ratio of false posi-

tives and false negatives.

In addition we will use trafﬁc traces from real

power grid that do not contain any attacks. We will

inject attack traces into these traces in order evaluate

the performance of the anomaly detection approach.

6 SUMMARY AND

CONCLUSIONS

This paper has shown that SDN can bring numerous

beneﬁts to smart grid communication infrastructures.

One of them is enhanced network visibility (situa-

tion awareness), in which trafﬁc ﬂows and associated

statistics from switches are available at a centralized

SDN controller. Due to the SDN conceptual architec-

ture this features is inherently provided by SDN.

The SDN controller’s APIs enable access to this

information and can be used to support the implemen-

tation of a wide-variety applications that are useful

for smart grid networks, including anomaly detection

systems.

An anomaly detection mechanism that has been

successfully applied to trafﬁc ﬂows is entropy-based

anomaly detection. This form of detection system can

identify attacks, such as DoS attacks or port scans,

which can have a severe impact on smart grids or

could be part of network reconnaissance for prepar-

ing an attack. As part of our ongoing research, we

will implement and validate our approach to entropy-

based detection on an SDN testbed, which consists of

an ONOS SDN controller and Edgecore OpenFlow

switches. To generate representative smart grid net-

work trafﬁc, a Raspberry Pi cluster has been devel-

oped that can, for example, be conﬁgured to represent

RTUs. Finally, we will verify our assumptions using

network traces from a real power grid.

As network re-conﬁguration in SDN can be done

easily we will investigate ways to mitigate attacks by

e.g. dropping all packets that are part of the DoS at-

tack or limiting the number of packets to a rate where

they have no impact on the smart grid.

ACKNOWLEDGEMENTS

The presented work is conducted in the research

project VirtueGrid, which is funded by the Austrian

Climate and Energy Fund (KLIEN, ref. 858873)

within the program e!MISSION (eCall 9096736).

REFERENCES

Ali, S. T., Sivaraman, V., Radford, A., and Jha, S. (2015).

A Survey of Securing Networks Using Software De-

ﬁned Networking. IEEE Transactions on Reliability,

64(3):1086–1097.

Aydeger, A., Akkaya, K., Cintuglu, M. H., Uluagac, A. S.,

and Mohammed, O. (2016). Software deﬁned net-

working for resilient communications in Smart Grid

active distribution networks. pages 1–6. IEEE.

Berde, P., Snow, W., Parulkar, G., Gerola, M., Hart, J.,

Higuchi, Y., Kobayashi, M., Koide, T., Lantz, B.,

O’Connor, B., and Radoslavov, P. (2014). ONOS: to-

wards an open, distributed SDN OS. In Proceedings

of the third workshop on Hot topics in software de-

ﬁned networking - HotSDN ’14, pages 1–6, Chicago,

Illinois, USA. ACM Press.

Braga, R., Mota, E., and Passito, A. (2010).

Lightweight DDoS ﬂooding attack detection us-

ing NOX/OpenFlow. In IEEE Local Computer

Anomaly Detection in Smart Grids based on Software Deﬁned Networks

163

Network Conference, pages 408–415, Denver, CO,

USA. IEEE.

Cahn, A., Hoyos, J., Hulse, M., and Keller, E. (2013).

Software-deﬁned energy communication networks:

From substation automation to future smart grids.

pages 558–563. IEEE.

Dacier, M. C., Konig, H., Cwalinski, R., Kargl, F., and Di-

etrich, S. (2017). Security Challenges and Opportuni-

ties of Software-Deﬁned Networking. IEEE Security

& Privacy, 15(2):96–100.

Dong, X., Lin, H., Tan, R., Iyer, R. K., and Kalbarczyk, Z.

(2015). Software-Deﬁned Networking for Smart Grid

Resilience: Opportunities and Challenges. In Pro-

ceedings of the 1st ACM Workshop on Cyber-Physical

System Security - CPSS ’15, pages 61–68, Singapore,

Republic of Singapore. ACM Press.

Dorsch, N., Kurtz, F., Georg, H., Hagerling, C., and

Wietfeld, C. (2014). Software-deﬁned networking

for Smart Grid communications: Applications, chal-

lenges and advantages. pages 422–427. IEEE.

Giotis, K., Argyropoulos, C., Androulidakis, G., Kalogeras,

D., and Maglaris, V. (2014). Combining OpenFlow

and sFlow for an effective and scalable anomaly de-

tection and mitigation mechanism on SDN environ-

ments. Computer Networks, 62:122–136.

International Electrotechnical Commission (2012). IEC TR

62351-10: Power systems management and associ-

ated information exchange - Data and communica-

tions security - Part 10: Security architecture guide-

lines.

Kim, Y.-J., He, K., Thottan, M., and Deshpande, J. G.

(2014). Virtualized and self-conﬁgurable utility com-

munications enabled by software-deﬁned networks. In

2014 IEEE International Conference on Smart Grid

Communications (SmartGridComm), pages 416–421,

Venice, Italy. IEEE.

Kuzlu, M., Pipattanasomporn, M., and Rahman, S.

(2014). Communication network requirements for

major smart grid applications in HAN, NAN and

WAN. Computer Networks, 67:74–88.

Lakhina, A., Crovella, M., and Diot, C. (2005). Min-

ing anomalies using trafﬁc feature distributions. In

Proceedings of the 2005 conference on Applications,

technologies, architectures, and protocols for com-

puter communications - SIGCOMM ’05, page 217,

Philadelphia, Pennsylvania, USA. ACM Press.

Lee, W. and Xiang, D. (2001). Information-theoretic mea-

sures for anomaly detection. In Proceedings of the

2001 IEEE Symposium on Security and Privacy, SP

’01, pages 130–, Washington, DC, USA. IEEE Com-

puter Society.

Medved, J., Varga, R., Tkacik, A., and Gray, K. (2014).

OpenDaylight: Towards a Model-Driven SDN Con-

troller architecture. In Proceeding of IEEE Interna-

tional Symposium on a World of Wireless, Mobile and

Multimedia Networks 2014, pages 1–6.

Mehdi, S. A., Khalid, J., and Khayam, S. A. (2011). Revis-

iting Trafﬁc Anomaly Detection Using Software De-

ﬁned Networking. In Sommer, R., Balzarotti, D., and

Maier, G., editors, Recent Advances in Intrusion De-

tection, volume 6961, pages 161–180. Springer Berlin

Heidelberg, Berlin, Heidelberg.

MENDES, G., NYLUND, J., and ANNALA, S. (2018). Lo-

cal energy markets: Opportunities, beneﬁts, and bar-

riers. Ljubljana.

National Institute of Standards and Technology (2014).

Guidelines for Smart Grid Cybersecurity. Technical

Report NIST Internal or Interagency Report (NISTIR)

7628 Rev. 1, National Institute of Standards and Tech-

nology.

Open Networking Foundation (2012). OpenFlow Switch

Speciﬁcation 1.3.0.

Rehmani, M. H., Davy, A., Jennings, B., and Assi, C.

(2018). Software Deﬁned Networks based Smart

Grid Communication: A Comprehensive Survey.

arXiv:1801.04613 [cs]. arXiv: 1801.04613.

Scott-Hayward, S., Natarajan, S., and Sezer, S. (2016).

A Survey of Security in Software Deﬁned Net-

works. IEEE Communications Surveys & Tutorials,

18(1):623–654.

Sperotto, A., Schaffrath, G., Sadre, R., Morariu, C., Pras,

A., and Stiller, B. (2010). An Overview of IP Flow-

Based Intrusion Detection. IEEE Communications

Surveys & Tutorials, 12(3):343–356.

Sydney, A., Nutaro, J., Scoglio, C., Gruenbacher, D., and

Schulz, N. (2013). Simulative Comparison of Mul-

tiprotocol Label Switching and OpenFlow Network

Technologies for Transmission Operations. IEEE

Transactions on Smart Grid, 4(2):763–770.

Wang, W., Xu, Y., and Khanna, M. (2011). A survey on the

communication architectures in smart grid. Computer

Networks, 55(15):3604–3629.

Yang, Y., McLaughlin, K., Littler, T., Sezer, S., Pranggono,

B., and Wang, H. F. (2013). Intrusion Detection Sys-

tem for IEC 60870-5-104 based SCADA networks. In

2013 IEEE Power & Energy Society General Meeting,

pages 1–5, Vancouver, BC. IEEE.

Zhang, J., Seet, B.-C., Lie, T.-T., and Foh, C. H. (2013). Op-

portunities for Software-Deﬁned Networking in Smart

Grid. In 2013 9th International Conference on Infor-

mation, Communications Signal Processing, pages 1–

SMARTGREENS 2019 - 8th International Conference on Smart Cities and Green ICT Systems

164