Search papers, labs, and topics across Lattice.
This paper introduces Substation Cyber Attack Strategy Phasing (SubCASP), a Hidden Markov Model-based approach that integrates intrusion detection system (IDS) data logs to identify and predict the phases of cyber attacks on digital substations. By leveraging an ATT&CK-based threat modeling framework, SubCASP enhances situational awareness by providing insights into the current attack phase, potential next steps, and historical attack paths. The evaluation on a reproducible attack-graph dataset shows that SubCASP maintains robustness across varying levels of IDS observability and scenarios with missing data logs, addressing a critical gap in existing cybersecurity measures for power systems.
SubCASP reveals the hidden phases of cyber attacks on digital substations, transforming how we detect and respond to threats in critical infrastructure.
Digital substations that comply with IEC 61850 have improved the operational efficiency of modern power systems. However, adversaries can abuse IEC 61850 communication to manipulate circuit breaker operations in substations, which can result in severe system impacts. These cyber attacks are crafted based on broader multi-phase strategies. The existing intrusion detection systems (IDSs) often flag only isolated symptoms. Thus, there is a lack of context in the attack phase to support the deployment of mitigation measures. This paper proposes Substation Cyber Attack Strategy Phasing (SubCASP), a Hidden Markov Model(HMM)- based method that fuses IDS data logs to infer the current attack phase, next attack phase, and retrospective attack path. The attack phases are derived from an ATT&CK-based threat modeling. The SubCASP model is trained and evaluated on a reproducible attack-graph dataset. Test results are presented to demonstrate the robustness of SubCASP for various IDS observability levels and missing IDS data logs scenarios.
