The IEC-61850 standard introduced multiple protocols to increase data visibility across various power grid systems. The Generic Object Oriented Substation Events (GOOSE) protocol in particular is designed for bay-level communications, distributing high-priority messages across a power grid through the use of Intelligent Electrical Devices (IEDs). However, the protocol's multicast messaging and time requirements create cybersecurity concerns that can be exploited by a malicious actor. While the literature has examined the protocol's cybersecurity vulnerabilities, there is limited research on the consequences for performance and cybersecurity of the protocol's implementation on physical IEDs. In this paper, we introduce a flexible and practical testbed for GOOSE implementation evaluations performed on different devices, and to enable the demonstration of how different implementations on physical devices aim to mitigate GOOSE's vulnerabilities. We show the results of our testbed generating GOOSE traffic at variable data rates, with varying packet sizes. These results are then compared and verified against an IED with GOOSE protocol functionality to validate protocol generation. While this paper focuses on IEC-61850 GOOSE, the testbed presented herein is not limited to a single protocol, however, and can easily be utilized to expand the evaluation scope to a variety of Operational Technology (OT) communications protocols.

Internet of Things (IoT) is becoming more pervasive in many installations, including homes, manufacturing plants, and industrial facilities of all kinds. The data that IoT produces is a reflection of usual behavior such as daily routines and scheduled tasks, but also from unexpected behavior due to unintentional or undesirable abnormalities. Here, we focus on achieving coordinated intelligence about normal and abnormal phenomena from multiple sensors that are geographically co-located in close proximity, monitoring and controlling a set of co-located devices. Given a set of co-located sensors, we seek an intelligent approach that would automatically determine the “normal” patterns of behaviors among the correlated sensors. After normal behavior is extracted, later monitoring should detect any deviant variations over time. An example application is an entry monitoring and alert system for facilities such as nuclear reactors, where badge readers, door locks, lights, weight trackers and other co-located sensors at the entry point are collectively tracked. To address this problem, we identify the possible solution approach that can be used to solve its different variants. The implemented model is developed as a combination of rules and Markov Chain methods.

The need for improved critical infrastructure and key resource security is unquestioned and there has been minimal emphasis on level-0 (PHY process) improvements. Wired signal distinct native attribute finger-printing is investigated here as a non-intrusive PHY-based security augmentation to support an envisioned layered security strategy. Results are based on experimental response collections from highway addressable remote transducer differential pressure transmitter devices from three manufacturers (Yokogawa, Honeywell, and Endress+Hauser) in an automated process control system. Device discrimination is assessed using time domain (TD) and slope-based FSK (SB-FSK) fingerprints input to multiple discriminant analysis, maximum likelihood and random forest (RndF) classifiers. For 12 different classes (two devices per manufacturer at two distinct set points), both classifiers performed reliably and achieved an arbitrary performance benchmark of average cross-class percent correct of %C > 90%. The least challenging cross-manufacturer results included near-perfect %C ≈ 100%, while the more challenging like-model (serial number) discrimination results included 90%Δ= 3% to %CΔ= 4% performance degradation.

Hackers have multiple avenues for accessing Industrial Control System (ICS) and can adversely impact network hardware, operating systems, and executables. This includes attacking hardware/software switches commonly used in waste water, water treatment, and power substation facilities. Unauthorized network intrusion can be mitigated by augmenting Media Access Control (MAC) based device identity (ID) verification processes using Physical-Layer (PHY) features. PHY augmentation is addressed here using Constellation Based Distinct Native Attribute (CB-DNA) features derived from unintentional Ethernet cable emissions. Collected emission symbols are mapped to a gradient-based binary constellation space where, for the first time, conditional constellation symbol features are used for device ID verification. Serial number discrimination is assessed using 16 devices from 4 different manufactures, with 12 serving as authorized devices and 4 (one from each manufacturer) serving as attacking rogue devices. Collectively considering 12,288 rogue attack scenarios using 256 verification models, the proposed CB-DNA method is promising and yielded average Rogue Reject Rates (RRR) of 85.2%26.0 dB using two network access criteria.