The power grid is a complex, interconnected system that requires the coordination of multiple entities to ensure the reliability of the system. System operators must be aware of the impacts of various natural and man-made contingencies through telemetry from their control systems, and they must also be aware of the integrity and availability of the cyber assets on their systems. A team of researchers from Pacific Northwest National Laboratory and Idaho National Laboratory have conducted a series of observations and interviews at power utilities to identify what information needs to be available for both control room dispatchers and cyber security analysts to maintain situation awareness of cyber security to effectively monitor the cyber assets on utility control systems. The researchers interviewed and observed control room dispatchers and spoke with regional control system engineers and cyber security analysts to define the context in which such information would be used. The results of this work will inform the design of a tool that will enhance cyber situation awareness and help facilitate effective communication between the various personnel and organizations with utility and other regional authorities during contingencies.

Cybersecurity and resiliency of wide-area monitoring, protection, and control (WAMPAC) applications is critically important to ensure secure, reliable, and economical operation of the bulk power system. WAMPAC relies heavily on the security of measurements and control commands transmitted over wide-area communication networks for real-time operational, protection, and control functions. The current “N-1” security criterion for grid operation is inadequate to address malicious cyber events; therefore, it is important to fundamentally redesign WAMPAC and to enhance energy management system applications to make them attack resilient. In this paper, we present three key contributions to enhance the cybersecurity and resiliency of WAMPAC. First, we describe an end-to-end attack-resilient cyber-physical security framework for WAMPAC applications encompassing the entire security life cycle including risk assessment, attack prevention, attack detection, attack mitigation, and attack resilience. Second, we describe a defense-in-depth architecture that incorporates attack resilience at both the infrastructure layer and the application layer by leveraging domain-specific security approaches at the WAMPAC application layer in addition to traditional cybersecurity measures at the information technology infrastructure layer. Third, we discuss several attack-resilient algorithms for WAMPAC that leverage measurement design and cyber-physical system model-based anomaly detection and mitigation along with illustrative case studies. We believe that the research issues and solutions identified in this paper will open up several avenues for research in this area. In particular, the proposed framework, architectural concepts, and attack-resilient algorithms would serve as essential building blocks to transform the “fault-resilient” grid of today into an “attack-resilient” grid of the future.

This paper describes the architecture of a high-speed regular expression matching system implemented by the [Ii][Ss][Uu][0-2]{4} team from Iowa State University for the 2010 MEMOCODE competition. The purpose of this system is to detect malicious patterns in high-speed network data streams. The core functionality is implemented on a Stratix III 260 FPGA, and software running on a Xeon processor is used to transfer data to/from main memory and the FPGA. An interesting aspect of this architecture is the novel use of context switching resources to avoid buffering packets of connections whose classification are pending. The implemented solution detects malicious patterns at over 500 Mbps, and is estimated to scale to support well over 400 rules on our Stratix III FPGA.