Optimal Inspection Points for Malicious Attack Detection in Smart Grids Suhankar Mishra1, Thang N. Dinh2, My T. Thai1, and Incheol Shin3 Dept. of Comp. & Inf. & Sci. & Eng., University of Florida, Gainesville, Florida, USA1 Dept. of Comp. Sci., Virginia Commonwealth University, Richmond, VA, USA2 Info. Security Dept., Mokpo National University Muan, Rep. of Korea3

Outline Motivation Optimal Inspection Points Problem Single-path routings: FPTAS for trees Multiple-path routing: FPTAS for SP-graphs Discussion

Motivation Smart grids = Old electricity network New communication Intelligence Automation SCADA (Distribution Supervisory Control and Data Acquisition) Transmits individual device status, distribution control commands, access logs, etc. Vulnerable to intercepting, tampering, and forging data

Motivation (cont.) Solution: Deep Packet Inspection (DPI) Challenges Advanced Firewalls for SCADA/ICS Dig deeper into the protocols to understand the message content and apply more detailed rules Challenges Cannot be deployed at all points (e.g. economic reason) Cannot scanned all messages (limited capacity) Strict latency constraints Exp: 3ms for fault isolation and protection control messages (IEC 61850)

Optimal Inspection Points (OIP) Problem 𝛿 𝑢 : DPI delay 𝑚 𝑢 : Capacity 𝑟: center 𝑓(𝑢, 𝑣): Packet flow 𝑂: Intmd nodes S: terminal nodes

OIP Problem (cont.) Input: A directed acyclic graph 𝑮=(𝑽, 𝑬) 𝑽= 𝒓 ∪𝑶 ∪𝑺, where 𝑟: SCADA center. All packets are forwarded towards 𝑟 S: Terminal nodes that might send malicious packets. O: Set of intermediate nodes where DPI can be deployed 𝜹 𝒖 : Delay caused by employing DPI at 𝑢, ∀𝑢∈𝑂 𝒎 𝒖 : Capacity (#packets) of DPI scanner at 𝑢, ∀𝑢∈𝑂 𝜹 𝒎𝒂𝒙 : Maximum allowable delay for DPI at 𝑟 Flow 𝒇 𝒖, 𝒗 ≥0: traffic(#packets) 𝑢→𝑣, ∀ 𝑢, 𝑣 ∈𝐸 Problem: Find a subset of points 𝐷⊆𝑉 to deploy DPI Accumulating delay at 𝑟 for DPI ≤ 𝛿 𝑚𝑎𝑥 Maximize the #scanned packets

Complexity Theorem 1: OIP problem is NP-complete, even when the graph is a simple path.

Single-path vs. Multi-path routing Single-path routing Multi-path routing (Single route, E.g. OSPF) (Different routes possible) #packets routed along (𝑢, 𝑣) is proportional to 𝑓(𝑢,𝑣) v u u

Single-path routing The graph is a tree rooted at 𝑟 There exists Fully Polynomial-Time Approximation Scheme

Single-path routing

Single-path: Dynamic Programming

Multi-path routing FPTAS for Series-Parallel graphs

Multi-path: FPTAS

Multi-path: FPTAS Series Operations Parallel Operations

Conclusions & Discussion Introduce Optimal Inspection Points problem in Smart Grids and prove its NP-completeness. FPTAS for single-path routing FPTAS for multi-path routing in SP-graphs Approximation Algorithms for Multi-path routing in general graph

Thank you for your listening! Questions & Answers Thank you for your listening!