![](bg6.png)
communicates with the utility company to send me-
ter readings, status checks, power quality and outage
measurements, and remote updates. Unlike P1, P3
supports two-way communication. P3 energy data are
not available in real-time. There is an additional P4
port that allows the utility company to provide meter-
ing information to third parties.
Data Inference. Using the data transmitted by smart
meters, there are two methods to infer more user data.
The first method, called Non-Intrusive Load Mon-
itoring (NILM) (Lisovich et al., 2010), allows to in-
fer information such as location and behavior of users
(e.g., if they are at home), the amount of energy they
consume, and the type of devices they own. NILM
separates the energy data into categories, such as heat-
ing, appliances, entertainment, lighting, hot water,
and cooking. Based on these categories, the utility
company can use disaggregation techniques to infer
details on the energy fingerprint of each appliance.
Anyone who gets hold of this data gets a glimpse of
what appliances are used and how often they are used.
This allows to get details on the electricity consump-
tion of an individual household or an entire neighbor-
hood. NILM is successful in the HAN and small busi-
nesses because of the low event generation rate and
number of loads at these sites. Larger commercial
and industrial facilities require a more sophisticated
approach, due in part to high rates of event genera-
tion, load balancing, and power factor correction.
The second method relies on the real-time mon-
itoring capabilities of energy consumption profiles
from smartphone applications. This method can be
used to infer total energy consumption data. Based
on the total energy consumption data, an adversary
may infer presence information i.e. if the consumer is
at home. Nevertheless, it is difficult to derive energy
consumption profiles for the house appliances, as this
information is available from the utility company.
4 CURRENT SOLUTIONS
Cybersecurity systems should be layered and com-
bine Prevention, Detection and Mitigation (Butun and
¨
Osterberg, 2019). This Section discusses current so-
lutions to the challenges presented in Section 3, espe-
cially in the form of secure communication protocols
(for Prevention), network monitoring (for Detection)
and privacy regulations (for Mitigation).
4.1 Secure Communication Protocols
Secure protocols are crucial to avoid remote attacks
in smart grids. DNP3 and IEC 61850, presented in
Section 2.3, did not have inherent security from the
beginning. Therefore, Secure DNP3 and Secure IEC
61850 (known as IEC 62351) are proposed to achieve
end-to-end security for smart grid communications by
adding an extra layer in the protocol stacks called
“Encryption and Authentication” in between the Ap-
plication and Network layers. As discussed in Sec-
tion 2.3, DLMS has defined a data protection secu-
rity layer that provides encryption and authentication
mechanisms.
4.2 Network Monitoring
Network monitoring should be in place to detect com-
plex attacks. IDSs implement network monitoring
and they can be classified into three categories ac-
cording to their detection methodology: misuse-based
(also called signature-based), specification-based, and
anomaly-based. Signature-based detection is diffi-
cult to apply to smart grids, since their ever-growing
threat surface requires a constant rule-set update.
Specification-based IDS is also challenging due to
the difficulty of deriving specifications for the dy-
namically changing smart grid architectures. Finally,
anomaly-based IDS can, in principle, detect any kind
of bad (or anomalous) behavior by using either data-
oriented or behavior-oriented (Kwon et al., 2015)
mechanisms, tailored to the communication protocols
of Section 2.3.
Architecture and Deployment. To detect cyber-
attacks effectively, it is important to know where and
how to deploy network monitoring solutions on a
smart grid. Below, we present three possibilities for
deployment, using as a framework the architecture de-
scribed in Figure 1. For each deployment option, we
describe the placement of IDS components, their ad-
vantages and disadvantages.
Before describing the deployment of network
monitoring solutions, we must define their compo-
nents. Practical intrusion detection systems have at
least two components: a Monitoring Sensor and a
Command Center. The Monitoring Sensor is respon-
sible for sniffing the network traffic (usually pas-
sively, without injecting any traffic, to avoid disrupt-
ing the network or delaying other packets) and ei-
ther forwarding raw traffic or events (such as secu-
rity alerts and operational anomalies) to a Command
Center. The Command Center acts as a user inter-
face with which a security analyst can interact. It
also allows to connect multiple sensors, thus retriev-
ing traffic or events from multiple locations (e.g., sub-
stations). This kind of architecture is followed by
both commercial and open-source IDS.
It is also important to notice that modern com-
ICISSP 2020 - 6th International Conference on Information Systems Security and Privacy
738