Outlier Detection in Smart Grid Communication

Industrial Control System (ICS) networks transmit control and monitoring data in critical environments such as smart grid. Cyber attacks on smart grid communication may cause fatal consequences on energy production, distribution, and eventually the lives of people. Since the attacks can be initiated from both the inside and outside of the network, traditional smart grid security tools like firewalls or Intrusion Detection Systems (IDS), which are typically deployed on the edge of the network, are not able to detect internal threats. For this reason, we also need to analyze behavior of internal ICS communication.


I. INTRODUCTION
ICS communication provides proper functioning of critical infrastructure systems. These systems are naturally exposed to external threats including cyber attacks [1]. Traditionally, industrial systems are well protected against external threats through the use of firewalls and IDS devices that filter communication between ICS systems and Internet traffic, making direct attacks on smart grid communication a rare case. However, attackers can gain access to the system by sending malware to a user via an infected e-mail attachment [2].
The importance of the research is motivated by recent cyber attacks against critical infrastructure systems. One of the attacks against Ukrainian power company happened in December 23, 2015 when BlackEnergy malware caused power disruption to 225,000 customers, lasting up to 6 hours [2]. This attack included multiple stages starting with "spear phishing" e-mails targeting a staff to gain access to the corporate network of the power company. Once inside the power company network, attackers gathered credentials and used VPNs to get access to the internal network. More recent ransomware attack against the Colonial Gas Pipeline in the U.S. happened in May 2021 [3]. Similarly to BlackEnergy attack, it was also initiated from an infected internal station.
Compared to standard information and communication systems, smart grid communication exhibits stable, periodical, and regular communication patterns since the communication occurs between devices with no or little human interference. Typically, a controlling station periodically requests status data from a field device like the Programmable Logical Controller (PLC) or Remote Terminal Unit (RTU) in order to provide a real-time view on industrial processes.
To detect internal threats, we need (i) to regularly monitor smart grid communication and (ii) observe suspicious patterns that occur in the network traffic. One solution is to employ ICS monitoring using extended IPFIX protocol [4] that retrieves monitoring data about active ICS communication. To detect unknown adverse events or unusual behavior, we can observe statistical patterns using ICS flow data.
In this research, we closely examine statistical distribution of inter-arrival times of IEC 104 packets. This is a part of my PhD study that is focused on anomaly detection of ICS communication using statistical methods. The main idea behind the research comes out from stable communication patterns that are typical for ICS communication and can be observed on packet and flow levels. Within the PhD. research, we plan to apply various statistical methods on smart grid communication and evaluate their efficiency for covering common ICS attack vectors defined by MITRE ATT&CK for ICS matrix 1 .

A. Contribution
This research paper presents a proof-of-concept to outlier detection in smart grid communication. We observe packet inter-arrival times of IEC 104 communication and create a statistical profile of the normal traffic. Then we apply the Local Outlier Factor (LOF) algorithm to detect outliers which represent anomalies. Our preliminary results proves viability of this approach for statistical-based anomaly detection in ICS communication.

B. Structure of the Paper
This paper is structured as follows. In Section II we give an overview of published works related to statistical anomaly detection in ICS networks. Next, we briefly introduce IEC 104 protocol, statistical features and the LOF algorithm. Section IV shows our preliminary results. The last section concludes the work and discusses future steps.

II. RELATED WORK
Exploitation of timing attributes such as average packet inter-arrival times and the number of packets or bytes transmitted in a certain interval for anomaly detection has been studied in the past. Barbosa et al. [5], [6] investigated the use of spectral analysis to uncover traffic periodicity. Udd et al. [7] examined a TCP sequence prediction attack for the IEC 104 protocol. Other works mostly focused on flooding and DoS attacks [8]. We explore what attack vectors described by MITRE ATT&CK for ICS can be covered by LOF method.
To enhance detection ability of cyber attack, deep packet inspection (DPI) implemented in IDS tools and timing models have been proposed. Sayegh et al. [9] modelled the inter-arrival times between signatures (i.e., packet sequences) and validated this technique with large amount of injected signatures. Barbosa et al. [10] proposed to model the period of repeated requests in an orderless group. They evaluated the approach on Modbus and MMS datasets without attacks and set relaxed thresholds to avoid high false positive rates. This prevents the detection of subtle changes within a single period which is covered by our approach.
More recently, sequence-aware approaches have been explored. Yang et al. [11], Goldenberg and Wool [12], and Kleinmann and Wool [13] used finite automata to model message sequences of IEC 104, Modbus TCP and S7 respectively. Casselli et al. [14] modelled a sequence of messages using discrete-time Markov chains in order to detect sequence attacks. These approaches observe the order of messages. Since they require deep packet analysis, they have high demands on processing. Modeling of statistical behavior as proposed in this paper is fast and simple for implementation while giving comparable results.

A. Smart Grid Communication
Industrial protocols used in smart grid communication include protocol IEC 61850 (GOOSE, MMS), Modbus, IEC 104, DNP3, DLMS, and others [15]. These protocols transmit control and status data from industrial processes running on RTUs or IEDs. Protocols like IEC 104, DNP3, MMS or DLSM communicate using a client-server model. A master (controlling) station sends commands to a RTU slave (controlled station) in control direction while the slave delivers monitoring data in monitor direction. Protocols like GOOSE or Modbus use a publish-subscribe mechanism in which an application writes data into a local buffer, which is then periodically transmitted to a subscribed agent via L2 multicast.
1) IEC 104: IEC 104 protocol is an application protocol that consists of Application Protocol Control Information (APCI) and Application Service Data Unit (ASDU) sub-layers. It is implemented over TCP but for monitoring purposes we observe so-called virtual flows that represent records with a single ASDU packet transmitted on wire. We focus on interarrival times but there are additional attributes that can be used for statistical model: ASDU size which is also stable for specific IEC 104 commands, frequency of selected commands, e.g., spontaneous events, activations, packet size, etc.
2) Packets inter-arrival time: Packets inter-arrival time is the time taken between the arrival of two subsequent packets. It is computed as a difference between timestamps of two these packets. Inter-arrival time is characteristic for ICS transmissions and exhibits stable and predictable patterns. Changes in inter-arrival times indicate an anomaly on the communication channel. As demonstrated in our previous research [16], additional features like packet size or modeling of exact IEC 104 commands do not improve the accuracy of the statistical approach. We plan to confirm this observation by future experiments. For modelling inter-arrival time of industrial protocols with master-slave communication profile, it is natural to observe statistical distribution of bi-directional transmissions as depicted in Fig. 1.

3) Dataset:
In our experiments, we work with the IEC 104 protocol that is commonly used in smart grids for substation control. We utilise four datasets obtained from the Brno University of Technology testbed, see Tab. I. In order to test the ability of attack detection we created a set of ICS flow records with emulated attack and a AD testing tool 2 .

B. Statistical Outlier Detection
Outlier detection is a statistical technique that discovers data points that are inconsistent with the rest of the data. In general, outliers and inliers are determined using a data distribution model. This paper focuses on unsupervised outlier detection.
Unsupervised methods do not require data labels. As a result, they are more adaptable. The fundamental idea behind unsupervised outlier detection is to score data points solely on the essential characteristics of the dataset. In general, density or distance are used to determine whether a data point is an inlier (normal) or outlier (anomaly). In this proof-of-concept study, we apply Local Outlier Factor (LOF) method [17].
The scientific research on statistical outlier detection provides two approaches to handle outliers in a dataset. First, outliers must be identified for further investigative process.
Second, the data model should be designed to handle outlier data points accurately.

C. Detecting Outliers in Smart Grid
Outlier detection is a statistical procedure that finds suspicious events or items that differ from a dataset's normal form. Outliers are detected as data points that have a significantly lower density than their neighbors. The purpose of outlier detection is to detect rare events or unusual activities that differ from the majority of data points in a dataset [18]. Outlier detection can detect global or local outliers. For a global outlier, outlier detection considers all data points, and the data point is considered an outlier if it is far away from all other data points. The local outlier detection covers a small subset of data points at a time. A local outlier is based on the probability of data point being an outlier as compared to its local neighborhood which is measured by the k-Nearest Neighbors (kNN) algorithm. LOF is a densitybased unsupervised anomaly detection method that computes a given data point's local density deviation with respect to its neighbors. LOF scores are computed for all data points according to parameter k (the number of nearest neighbors) as follows [19]: Definition 1: d(p, o) is the Euclidean distance between two data points p and o. The distance between two data points p and o is calculated using an Euclidean n-dimensional space: Let D be a dataset and k a positive integer. For a data point p, the k-distance (p) is the distance d(p,o) between p and the farthest neighbor data point o by the following conditions: 1) At the least, k data points (records) o ∈ D\{p} maintains that d(p, o ) ≤ d(p, o). 2) At the most, k − 1 data points (records) o ∈ D\{p} maintains that d(p, o ) < d(p, o). Definition 2: k-Nearest Neighbors of p. The meaning of k-Nearest Neighbors of p is any data point q whose distance to the p data point is not greater than the k-distance(p).Those k-nearest neighbors of q form the so called k-distance neighborhood of p, as described below: Definition 3: Reachability distance of p with respect to o. Let k be a positive integer. The reachability distance of data point p with regard to o is as follows: The principle of LOF reachability is depicted in Fig. 2, further details are available at [17].

IV. PRELIMINARY RESULTS
We created a prototype 2 tool implementing LOF algorithm. We applied LOF on IEC 104 inter-arrival times in order to check if LOF modeling is suitable for ICS communication. We used LOF algorithm to learn inter-arrival time distribution of the transmitted IEC 104 packets by computing the k-distance, reachability distance and density of data points. The algorithm uses the learned model to raise an alarm for packets that significantly differ from the model. Figures 3 and 4 present a graphical representation of inter-arrival times of two datasets. The red points denote inter-arrival time distribution detected as anomaly (outliers) while the blue points represent normal communication. We discovered that applying LOF to a large data stream is extremely computationally inefficient and may lead to incorrect prediction results. We then applied the LOF on time windows where each data block contains 5000 inter-arrival time records.
The main advantage of the LOF algorithm is that it works well with stream data and detects outliers with respect to Fig. 4. Anomaly detection in mega104-14-12-18 PCAP file density of their neighbouring data records. Also, this algorithm is able to detect outliers regardless of the data distribution of normal behavior, since it does not make any assumptions about the distribution of data records. Our preliminary results show that the proposed method works well with ICS data and is easy to operate.
Validation tests were applied to determine the viability of the proposed technique. We tested the stability of the approach using our datasets. For our validation tests, we divided normal communication into two parts. We used the first two thirds of the communication to train the model. Then, we tested these ranges on the last third of data. After testing, we classified all testing packets as normal communication. The results demonstrate high accuracy of the proposed approach. The method did not produce any false positive during the test.

V. CONCLUSION
In this paper, we presented a proof-of-concept method for anomaly detection of smart grid control protocols. We observed inter-arrival times of IEC 104 communication and applied LOF algorithm for outlier detection. The preliminary results show that LOF creates a stable statistical model for ICS traffic and is able to detect outliers caused by cyber attacks. The proposed security mechanism was tested and validated using our IEC 104 datasets. Experiments show the suitability, usability and high accuracy of the proposed method on smart grid communication. In the future work we plan to apply this approach to other ICS protocols like GOOSE, MMS and DLMS. We also plan to observe other statistical features like packet or flow size. Although our key goal was to test the applicability of the proposed solution, we also tested the performance of the developed tool. We gathered basic time statistics. The processing time of extracting key attributes from the PCAP file into a CSV file took an average of one minute and 10 seconds. This time had small deviations because it takes time to initialize Tshark. The time to learn a CSV file depends on the number of packets. At average, to learn 5,000 packets, 20 seconds were required.
The results are part of my PhD research that focused on statistical-based anomaly detection in ICS protocols. In the future work, we focus is extending detection model to common cyber attacks defined by MITRE ATT&CK ICS matrix.

ACKNOWLEDGMENT
The work is supported by the Brno University of Technology project "Application of AI methods to cyber security and control systems", no. FIT-S-20-6293.