Connected and digital electricity substations based on IEC–61850 standards enable novel applications. On the other hand, such connectivity also creates an extended attack surface. Therefore, Intrusion Detection Systems (IDSs) have become an essential component of safeguarding substations from malicious activities. However, in contrast to traditional information technology systems, there is a serious lack of realistic data for training, testing, and evaluating IDSs in smart grid scenarios. Many existing substation IDSs rely on datasets from other contexts or on proprietary datasets that do not allow reproducibility, validation, or performance comparison with competing algorithms. To address this issue, we propose the Efficacious Reproducer Engine for Network Operations (ERENO) synthetic traffic generation framework based on the IEC–61850 standard specifications. As an additional contribution, and as a proof-of-concept, we create and make available a suite of realistic IEC–61850 datasets that model 8 use cases, namely traffic for 7 common attacks and one for normal network traffic. Based on those datasets, we further evaluate how enriched features combining raw data from the substation can significantly improve intrusion detection performance. Our results suggest that it can improve F1-Score up to 47.22% for masquerade attacks.

Cyber-Physical Systems (CPS) are the basis for the world’s critical infrastructure and, thus, have the potential to significantly impact human lives in the near future. In recent years, there has been an increasing demand for connectivity in CPS, which has brought to attention the issue of cybersecurity. Aside from traditional information systems threats, CPS face new challenges due to the heterogeneity of devices and protocols, as well as its strong reliability requirements. In this work, we provide a brief overview of the CPS architecture and applications and describe the security challenges in the three CPS layers of perception, transmission, and application. Besides, we discuss how feature selection (FS) may improve intrusion detection performance. In particular, we evaluate how metaheuristic approaches can improve classification performance in CPS perception, transmission, and application layers. Our results reveal that (i) Greedy Randomized Adaptive Search Procedure (GRASP) outperforms traditional filter-based methods, and (ii) using the proposed enhanced approaches in GRASP construction and local search phases can enhance the average F1-Score of five classifier algorithms.

Wireless sensor networks (WSNs) are commonly adopted by the Industrial Internet-of-Things (IIoT) scenarios due to their easy and fast deployment. However, WSNs are especially vulnerable to security attacks as reflexive packet flooding Denial of Service (DoS) may occur. Admission control and reputation-based strategies are effective for attack detection. However, mitigation strategies to deal with the effects of these attacks, such as congestion channel transmission is an open issue. Additionally, the resource-constrained nature of nodes, such as the low bandwidth, limited memory, and battery within WSNs, poses a challenge to develop efficient mechanisms in such a scenario. To address this issue, we propose a distributed congestion control by duty-cycle restriction (D-ConCReCT) to detect and mitigate DoS in IIoT. The main goal is to investigate its feasibility in large-scale networks, as well as its ability to reduce both the detection and mitigation times when compared to a previous centralized approach, the so-called congestion control by duty-cycle restriction (ConCReCT). Our results indicate that D-ConCReCT may be applied in the mitigation of DoS attacks in a sensor network scenario with 500 nodes.

The Smart Grid is a high availability system that requires fault recovery protocols to minimize downtime. In addition, recovery, in most cases, must be made within certain temporal constraints. The IEC 62493-3 standard defines the Parallel Redundancy Protocol (PRP) and High-availability Seamless Redundancy (HSR) as protocols for dealing with link layer communication failures in electrical substations. There are variations that perform the same functionality handling packets at the IP layer, such as iPRP. Those protocols promise zero-time recovery by proactively sending duplicate packets across distinct and independent paths. In this paper, those fault recovery protocols are analyzed by means of simulations. Our results show that, in realistic setups, recovery time is never actually zero and that, under certain conditions, this time can exceed the temporal requirements that some protection applications demand for proper operation.

Electronic health record systems are important tools employed for accessing and maintaining patient data, such as the history of hospitalizations and medical exams. Nowadays, physicians, nurses and hospital staff need fast and secure access to medical records avoiding bureaucracy for patient information retrieval and imprecision in patient's data maintenance. Ubiquitous and pervasive computing can contribute to overcoming such challenges; however the device impersonation problem should be carefully addressed in this scenario. To deal with such problem, this paper presents a secure architecture based on ubiquitous and pervasive computing for medical records retrieval and maintenance. Such architecture relies on Near Field Communication (NFC) for message exchange between smartphones and tags. An authentication mechanism is presented and validated to ensure device authentication. Analytical results reveal that such mechanism is efficient in providing mutual authentication. Additionally, another important security properties are reached, as confidentiality, message anti-replay and device anti-tracking. Finally, as proof of concept, we present a medication delivery study case based on a developed prototype.