SPEAR SIEM: A Security Information and Event Management system for the Smart Grid
| Autor: | Saturnino Martinez, Michalis Tzifas, Panagiotis Radoglou-Grammatikis, Michail Angelopoulos, Panagiotis Sarigiannidis, Erkuden Rios, Eider Iturbe, Francisco Ramos, Nikolaos Vakakis, Georgios Eftathopoulos, Alkiviadis Giannakoulias, Achilleas Sesis, Antonios Sarigiannidis, Yannis Spyridis, Ioannis Giannoulakis, Dimitrios Tzovaras, Emmanouil Kafetzakis |
|---|---|
| Jazyk: | angličtina |
| Předmět: |
Cybersecurity
Computer Networks and Communications Emerging technologies Computer science 02 engineering and technology Intrusion detection system Anomaly detection Computer security computer.software_genre Security information and event management SCADA Security Information and Event Management Home automation Machine learning 0202 electrical engineering electronic engineering information engineering Intrusion detection Smart Grid business.industry 020206 networking & telecommunications Deep learning Electrical grid Smart grid 020201 artificial intelligence & image processing Communications protocol business computer |
| Zdroj: | Computer Networks. 193:108008 |
| ISSN: | 1389-1286 |
| DOI: | 10.1016/j.comnet.2021.108008 |
| Popis: | The technological leap of smart technologies has brought the conventional electrical grid in a new digital era called Smart Grid (SG), providing multiple benefits, such as two-way communication, pervasive control and self-healing. However, this new reality generates significant cybersecurity risks due to the heterogeneous and insecure nature of SG. In particular, SG relies on legacy communication protocols that have not been implemented having cybersecurity in mind. Moreover, the advent of the Internet of Things (IoT) creates severe cybersecurity challenges. The Security Information and Event Management (SIEM) systems constitute an emerging technology in the cybersecurity area, having the capability to detect, normalise and correlate a vast amount of security events. They can orchestrate the entire security of a smart ecosystem, such as SG. Nevertheless, the current SIEM systems do not take into account the unique SG peculiarities and characteristics like the legacy communication protocols. In this paper, we present the Secure and PrivatE smArt gRid (SPEAR) SIEM, which focuses on SG. The main contribution of our work is the design and implementation of a SIEM system capable of detecting, normalising and correlating cyberattacks and anomalies against a plethora of SG application-layer protocols. It is noteworthy that the detection performance of the SPEAR SIEM is demonstrated with real data originating from four real SG use case (a) hydropower plant, (b) substation, (c) power plant and (d) smart home. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|