1. Optimal Inspection Points for Malicious Attack Detection in Smart Grids
Suhankar Mishra1, Thang N. Dinh2, My T. Thai1, and Incheol Shin3
Dept. of Comp. & Inf. & Sci. & Eng., University of Florida, Gainesville, Florida, USA1
Dept. of Comp. Sci., Virginia Commonwealth University, Richmond, VA, USA2
Info. Security Dept., Mokpo National University Muan, Rep. of Korea3

2. Outline Motivation Optimal Inspection Points Problem
Single-path routings: FPTAS for trees
Multiple-path routing: FPTAS for SP-graphs
Discussion

3. Motivation Smart grids =
Old electricity network
New communication
Intelligence
Automation
SCADA (Distribution Supervisory Control and Data Acquisition)
Transmits individual device status, distribution control commands, access logs, etc.
Vulnerable to intercepting, tampering, and forging data

4. Motivation (cont.) Solution: Deep Packet Inspection (DPI) Challenges
Advanced Firewalls for SCADA/ICS
Dig deeper into the protocols to understand the message content and apply more detailed rules
Challenges
Cannot be deployed at all points (e.g. economic reason)
Cannot scanned all messages (limited capacity)
Strict latency constraints
Exp: 3ms for fault isolation and protection control messages (IEC 61850)

5. Optimal Inspection Points (OIP) Problem
𝛿 𝑢 : DPI delay 𝑚 𝑢 : Capacity
𝑟: center
𝑓(𝑢, 𝑣): Packet flow
𝑂: Intmd nodes
S: terminal nodes

6. OIP Problem (cont.) Input: A directed acyclic graph 𝑮=(𝑽, 𝑬)
𝑽= 𝒓 ∪𝑶 ∪𝑺, where
𝑟: SCADA center. All packets are forwarded towards 𝑟
S: Terminal nodes that might send malicious packets.
O: Set of intermediate nodes where DPI can be deployed
𝜹 𝒖 : Delay caused by employing DPI at 𝑢, ∀𝑢∈𝑂
𝒎 𝒖 : Capacity (#packets) of DPI scanner at 𝑢, ∀𝑢∈𝑂
𝜹 𝒎𝒂𝒙 : Maximum allowable delay for DPI at 𝑟
Flow 𝒇 𝒖, 𝒗 ≥0: traffic(#packets) 𝑢→𝑣, ∀ 𝑢, 𝑣 ∈𝐸
Problem: Find a subset of points 𝐷⊆𝑉 to deploy DPI
Accumulating delay at 𝑟 for DPI ≤ 𝛿 𝑚𝑎𝑥
Maximize the #scanned packets

7. Complexity
Theorem 1: OIP problem is NP-complete, even when the graph is a simple path.

8. Single-path vs. Multi-path routing
Single-path routing Multi-path routing
(Single route, E.g. OSPF) (Different routes possible)
#packets routed along (𝑢, 𝑣) is proportional to 𝑓(𝑢,𝑣) v u u

9. Single-path routing The graph is a tree rooted at 𝑟
There exists Fully Polynomial-Time Approximation Scheme

10. Single-path routing

11. Single-path: Dynamic Programming

12. Multi-path routing
FPTAS for Series-Parallel graphs

13. Multi-path: FPTAS

14. Multi-path: FPTAS
Series Operations
Parallel Operations

15. Conclusions & Discussion
Introduce Optimal Inspection Points problem in Smart Grids and prove its NP-completeness.
FPTAS for single-path routing
FPTAS for multi-path routing in SP-graphs
Approximation Algorithms for Multi-path routing in general graph

16. Thank you for your listening!
Questions & Answers
Thank you for your listening!