SCAPHY: Detecting Modern ICS Attacks by Correlating Behaviors in SCADA and Physical.
Abstract not provided.
Ike, Moses↗
SEARCH · Engineering Papers
Results for “SCADA”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Virtual supervisory control and data acquisition (SCADA) automation controller
One or more virtual supervisory control and data acquisition (SCADA) controllers are provided. The virtual SCADA controller(s) may be deployed upon a detection of a failure of a physical SCADA controller. An on-site module may detect failure including a security breach which causes the physical SCADA controller to be disconnected from a network and the virtual SCADA controller(s) to take over control. The virtual SCADA controller(s) may be on-site or off-site.
Smith, Jared M.↗
Hardware-Based Randomized Encoding for Sensor Authentication in Power Grid SCADA Systems
Supervisory Control and Data Acquisition (SCADA) systems are utilized extensively in critical power grid infrastructures. Modern SCADA systems have been proven to be susceptible to cyber-security attacks and require improved security primitives in order to prevent unwanted influence from an adversarial party. One section of weakness in the SCADA system is the integrity of field level sensors providing essential data for control decisions at a master station. In this paper we propose a lightweight hardware scheme providing inferred authentication for SCADA sensors by combining an analog to digital converter and a permutation generator as a single integrated circuit. Through this method we encode critical sensor data at the time of sensing, so that unencoded data is never stored in memory, increasing the difficulty of software attacks. We show through experimentation how our design stops both software and hardware false data injection attacks occurring at the field level of SCADA systems.
42 ENGINEERING↗
Wind turbine gearbox fault prognosis using high-frequency SCADA data
Condition-based maintenance using routinely collected Supervisory Control and Data Acquisition (SCADA) data is a promising strategy to reduce downtime and costs associated with wind farm operations and maintenance. New approaches are continuously being developed to improve the condition monitoring for wind turbines. Development of normal behaviour models is a popular approach in studies using SCADA data. This paper first presents a data-driven framework to apply normal behaviour models using an artificial neural network approach for wind turbine gearbox prognostics. A one-class support vector machine classifier, combining different error parameters, is used to analyse the normal behaviour model error to develop a robust threshold to distinguish anomalous wind turbine operation. A detailed sensitivity study is then conducted to evaluate the potential of using high-frequency SCADA data for wind turbine gearbox prognostics. The results based on operational data from one wind turbine show that, compared to the conventionally used 10-min averaged SCADA data, the use of high-frequency data is valuable as it leads to improved prognostic predictions. High-frequency data provides more insights into the dynamics of the condition of the wind turbine components and can aid in earlier detection of faults.
17 WIND ENERGY↗
Prognosis of Wind Turbine Gearbox Bearing Failures Using SCADA and Modeled Data
Predictive maintenance and condition monitoring systems for wind turbines have seen increased adoption to minimize downtime, reducing operation and maintenance costs. On today’s wind power plants, the integrated supervisory control and data acquisition (SCADA) system provides low- frequency operational data that can be leveraged to quantify a wind turbine’s health. The aim of this study is to utilize machine-learning techniques to predict axial cracking failures in wind turbine gearbox bearings up to 1 month ahead of time. The failures are assumed to have occurred when the investigated bearing was replaced. While current SCADA systems show the overall condition of a wind turbine, often they do not allow for the investigation of specific gearbox bearings’ health. To enrich bearing fault signatures, additional data are computed through physics-based models using gearbox design information. Based on SCADA data, modeled data, and bearing failure log data from an actual wind plant, the performances of different machine-learning models on unseen data are then evaluated using industry-standard metrics such as precision, recall, and F1 score. Results show the overall system performance enhancement in predicting bearing failure when modeled data are included with SCADA data. The reduction in terms of false alarms is about 50%, and improvement in terms of precision and F1 score is about 33% and 12% respectively, based on the best modeling case in this study.
49 EE - Wind and Water Power Program - Wind (EE-4W↗
Supporting Cyber Security of Power Distribution Systems by Detecting Differences Between Real-time Micro-Synchrophasor Measurements and Cyber-Reported SCADA (Final Report)
As modern power grids tend towards greater levels of automation and communication, the challenges of identifying and mitigating vulnerabilities to cyber-attacks are ones that are increasingly demanding attention. Today’s power system has evolved to form the foundational bedrock of modern society, and an attack on this infrastructure could prove disastrous. In this project we were tasked to investigate the use of distribution synchrophasors as an independent isolated sensor network with which we can corroborate, or flag potentially spoofed,Supervisory Control And Data Acquisition (SCADA) data. We adapted an approach to marry the underlying physical properties of power systems with the network communications used by power systems in order to offer insights unattainable by either data stream isolation. While the concept of intrusion detection systems (IDS) is well understood for monitoring network traffic and traditional IT computing systems, the approach discussed in this report is motivated by several key notions: first, current SCADA communications alone presents an incomplete view of the grid. Second, the power grid, and the equipment controlling it, is grounded by laws of physics. Given this, we leverage high-frequency physical grid measurements to understand the physical condition of the grid, and combine this with SCADA. While high-frequency physical grid measurements and SCADA communication over Internet Protocol (IP) networks are fundamentally disparate information sources, when collectively examined through appropriate lenses, they offer a much more nuanced depiction of the grid.
24 POWER TRANSMISSION AND DISTRIBUTION↗
Machine Learning for Gearbox Fault Prediction by Using Both Scada and Modeled Data
This presentation outlines the work in the paper titled "Prognostics of Wind Turbine Gearbox Bearing Failures Using SCADA and Modeled Data" published by the PHM Society and presented at its 2020 annual conference. It is accessible at https://papers.phmsociety.org/index.php/phmconf/article/download/1292/862. The technical work is on machine learning approaches for prognostics for gearbox faults. The methodology combines SCADA time series data and physics domain modeling data, derived from the models developed by the NREL team, as inputs to machine learning models to predict gearbox bearing failures with one month lead time. Based on SCADA data, modeled data, and bearing failure log data from an actual wind plant, the performances of different machine-learning models on unseen data are then evaluated using industry-standard metrics such as precision, recall, and F1 score, and AUC (area under receiver operating characteristic curve). Results show the overall system performance enhancement in predicting bearing failure when modeled data are included with SCADA data. The reduction in terms of false alarms is about 50%, and improvement in terms of precision, and F1 score, and AUC is about 33%, and 12%, and 6% respectively, based on the best modeling case in this study.
49 EE - Wind and Water Power Program - Wind (EE-4W↗
Distributed Intrusion Detection System using Semantic-based Rules for SCADA in Smart Grid
Cyber-physical system (CPS) security for the smart grid enables secure communication for the SCADA and wide-area measurement system data. Power utilities world-wide use various SCADA protocols, namely DNP3, Modbus, and IEC 61850, for the data exchanges across substation field devices, remote terminal units (RTUs), and control center applications. Adversaries may exploit compromised SCADA protocols for the reconnaissance, data exfiltration, vulnerability assessment, and injection of stealthy cyberattacks to affect power system operation. In this paper, we propose an efficient algorithm to generate robust rule sets. We integrate the rule sets into an intrusion detection system (IDS), which continuously monitors the DNP3 data traffic at a substation network and detects intrusions and anomalies in real-time. To enable CPS-aware wide-area situational awareness, we integrated the methodology into an open-source distributed-IDS (D-IDS) framework. The D-IDS facilitates central monitoring of the detected anomalies from the geographically distributed substations and to the control center. The proposed algorithm provides an optimal solution to detect network intrusions and abnormal behavior. Different types of IDS rules based on packet payload, packet flow, and time threshold are generated. Further, IDS testing and evaluation is performed with a set of rules in different sequences. The detection time is measured for different IDS rules, and the results are plotted. All the experiments are conducted at Power Cyber Lab, Iowa State University, for multiple power grid models. After successful testing and evaluation, knowledge and implementation are transferred to field deployment.
24 POWER TRANSMISSION AND DISTRIBUTION↗
Cybersecurity Anomaly Detection in SCADA-Assisted OT Networks Using Ensemble-Based State Prediction Model
The cybersecurity threats of power system gradually grow due to the increased sophisticated interactions between Information Technology (IT) and Operational Technology (OT) networks. False data injection attack (FDIA) that aims to compromise the Supervisory Control and Data Acquisition (SCADA) measurement and disturb the system operation is one of such cyber threats. Such attacks can potentially lead to significant operational issues at the control centers and substations, and hence, result in severe physical consequences. To avoid catastrophic failure across the power grid resulting from these attacks, it is essential to arm the OT network with real-time vulnerability assessment tools. To this end, this paper outlines various drawbacks of the Purdue architecture model to defend against cyberattacks in the OT network. Furthermore, a novel ensemble-based state prediction model is proposed to detect cybersecurity anomalies in SCADA assisted OT networks. The proposed model uses control center level generation and load forecasts, scheduled, and forced outages, power flow solutions, and the substation level historical data. The hypothesis of the proposed scheme relies on the fact that additional control center and substation data can hardly be accessed and compromised by attackers. One of the vital features of the proposed scheme is an hour-ahead prediction of the operational feasibility of the SCADA measurement range at the control center and substation in real time helps in detecting anomalies in measurements across both substation and the control center.
24 POWER TRANSMISSION AND DISTRIBUTION↗
Methods and systems for detection of man-in-the-middle attacks for SCADA communication networks and applications of same
A system for detecting MITM for SCADA communication networks includes secure substation-substation communication links for providing secure and reliable paths to exchange OT data between substations for OT data consistency check; a SIB in each substation for sampling CT and PT measurements to calculate voltage magnitude and phase angle thereof; a S&C server in each substation coupled to the SIB for receiving the voltage magnitude and phase angle from the SIB and obtaining a packet carrying active power flow in transmission lines between two substations and a time stamp; an IDS server placed in a SCADA center for collecting the packet of each substation sent by the S&C server; analyzing the received packet from every adjacent substation; inspecting the payload of the received packet; and triggering an intrusion alarm to a SCADA operator when the power flow is not the same as the payload of the packets.
McCann, Roy A.↗
Uncertainty Error Modeling for Non-Linear State Estimation With Unsynchronized SCADA and µPMU Measurements
Distribution systems of the future smart grid require enhancements to the reliability of distribution system state estimation (DSSE) in the face of low measurement redundancy, unsynchronized measurements, and dynamic load profiles. Micro phasor measurement units (µPMUs) facilitate co-synchronized measurements with high granularity, albeit at an often prohibitively expensive installation cost. Supervisory control and data acquisition (SCADA) measurements can supplement µPMU data, although they are received at a slower sampling rate. Further complicating matters is the uncertainty associated with load dynamics and unsynchronized measurements–not only are the SCADA and µPMU measurements not synchronized with each other, but the SCADA measurements themselves are received at different time intervals with respect to one another. This paper proposes a non-linear state estimation framework which models dynamic load uncertainty error by updating the variances of the unsynchronized measurements, leading to a time-varying system of weights in the weighted least squares state estimator. Case studies are performed on the 33-Bus Distribution System in MATPOWER, using Ornstein–Uhlenbeck stochastic processes to simulate dynamic load conditions.
Cooper, Austin↗
Enabling Interoperable SCADA Communications for PV Inverters through Embedded Controllers
The percentage integration of photovoltaic (PV) inverters in the field has increased significantly in the past 5 years. Regardless of the size of the PV plants and the inverters (residential vs. commercial), it is becoming crucial that these devices have the capability to communicate with peers (other smart devices) and with components that are at a hierarchy above the inverters (e.g., supervisory control and data acquisition (SCADA) systems, distributed controllers, and data managers). This project aims to develop a standard SCADA software code for inverters’ embedded controllers that will enable interoperability with other components in the system. To achieve this, the code will be developed using two different protocols: Distributed Network Protocol 3 and International Electrotechnical Commission 61850. The developed code is aimed to be deployed in simple embedded controllers. It will be tested in the National Renewable Energy Laboratory’s (NREL’s) Energy Systems Integration Facility. The tested code will then be made available through Triangle MicroWorks’s (TMW’s) software platform. The primary objectives of this project include training the NREL team with TMW’s embedded controller libraries, developing an interoperable communication code for embedded controllers, successfully testing and deploying the code, and demonstrating the newly developed code in a conference.
14 SOLAR ENERGY↗
Companion Assisted Software Based Remote Attestation in SCADA Networks
Critical infrastructure such as power generation and water distribution systems have become a priority target in cyber warfare because of their recent computerization and introduction to the internet. As a result, Supervisory Control and Data Acquisition (SCADA) system security has become a hot topic in academic and industrial research. Among these topics, Remote Attestation is a security method intended to detect the presence of fileless malware in remote devices as they continue to operate. This allows for the detection of malware in the absence of long-term storage artifacts before symptoms of compromise begin to appear. In general, a trusted device (the verifier) makes a request for evidence of innocence from the untrusted device (the prover). In software-based schemes, the verifier can then measure the delay between its request and the prover’s response. If this delay is greater than the known computational time of the evidence gathering algorithm performed by the prover, then evidence may have been forged. Multi-hop networks often introduce too much network jitter to allow accurate measurement of prover response time, which limits the effectiveness of software based Remote Attestation in a real-world setting. In this work, we introduce a companion device that the verifier can trust to perform a subset of attestation, thereby removing any network jitter. This device is a Field Programmable Gate Array (FPGA) that is physically connected to the prover. We provide a communication protocol between the verifier, prover, and companion. To evaluate our scheme, we simulate it in a common SCADA network environment under normal and heavy traffic loads. Our simulations are performed in the discrete event network simulator NS-3, and we perform statistical analysis over our results to show that our scheme allows for tight timing constraints to be placed on the prover such that the verifier can more easily determine the validity of the evidence that it receives.
Johnson, William A.↗
Data Management for Digital Twin Implementation: Enhancing Existing SCADA Architecture for INL's CITRC Test Distribution System
The United States power grid will continue to experience stress from aging infrastructure, extreme weather, and increasing loads. In order to strengthen resiliency, researchers need to run tests and simulations that model real-life infrastructure. Idaho National Laboratory (INL) is creating a digital twin of its Critical Infrastructure Test Range Complex (CITRC). CITRC is an at-scale grid testbed which can be configured in utility-realistic distribution scenarios for a variety of tests, such as advanced grid protection and control. A digital twin of this infrastructure would support in-depth tests/simulations without risking physical consequences, before trialing devices under test at-scale. This project focuses on the data acquisition part of constructing a digital twin. It investigates the Supervisory Data Acquisition and Control (SCADA) system of CITRC and explores ways to utilize this system for the twin. Future “ideal” at-scale implementations such as upgraded equipment, modern communication protocols, and automation applications are also explored.
24 - POWER TRANSMISSION AND DISTRIBUTION↗
VAC: A Software Approach to Resilient SCADA Automation
To better secure critical infrastructure, especially power systems, this paper introduces a virtual SCADA automation controller. The automation controller is a gateway into a power subsystem, making it a valuable target for cyber-attacks that could cut it off from the control center and cause a loss of view and control. To prevent this, the Virtual Automation Controller (VAC) is a backup device that mirrors the capabilities of the physical controller. It can communicate via Modbus and DNP3 and is containerized so it can be deployed on a variety of platforms. Furthermore, it utilizes software-defined networking to quickly disconnect a failed automation controller and preserve its state for forensics. The VAC gives system operators time to replace the failed controller and prevents dangerous and costly damage to power systems. The VAC is compared against the SEL 3505-3 RTAC and shown to have the necessary features to act as a failover controller.
Johnson, Jordan↗
FLASC (FLORIS-based Analysis for SCADA data)
FLASC provides a rich suite of analysis tools for SCADA data filtering & analysis, wind farm model validation, field experiment design, and field experiment monitoring. The repository is centrally built around NRELs in-house floris wind farm model, available at https://github.com/nrel/floris. FLASC also largely relies on the energy ratio to, among others, quantify wake losses in synthetic and historical data, to perform turbine northing calibrations, and for model parameter estimation.
Fleming, Paul↗
Validation of FAST.Farm Against Full-Scale Turbine SCADA Data for a Small Wind Farm
FAST.Farm is a new midfidelity engineering tool developed by the National Renewable Energy Laboratory targeted at accurately and efficiently predicting wind turbine power production and structural loading in wind farm settings, including wake interactions between turbines. FAST.Farm is based on some of the principles of the Dynamic Wake Meandering model—including passive tracer modeling of wake meandering—but addresses many of the limitations of previous Dynamic Wake Meandering (DWM) implementations. Previous FAST.Farm verification studies show the similarities and differences between FAST.Farm and large-eddy simulations for rigid and flexible turbines. In this validation study, FAST.Farm turbine responses are compared to multiturbine measurements from a subset of a full-scale wind farm. FAST.Farm predictions of turbine generator power, rotor speed, and blade pitch for five-turbine simulations are compared to supervisory control and data acquisition results. Results reveal that FAST.Farm generator power mean and standard deviation results reasonably match measured data for upstream and downstream turbines, as well as the mean rotor speed and blade pitch above rated wind speeds. However, FAST.Farm generally underpredicts the mean rotor speed and overpredicts the mean blade pitch below rated operation. These errors are likely related to inaccuracies in the generic controller simulated. Despite controller differences, FAST.Farm predicts the same overall relative rotor power trends for all waked turbines at all wind speeds.
17 WIND ENERGY↗
Cyber-Informed Engineering Workbook: SCADA (VoltVAR)
This case study workbook provides a hypothetical project to support discussion and application of Cyber-Informed Engineering principles. Participants in the workshop are encouraged to use the workbook to capture insights and lessons learned.
42 - ENGINEERING↗