ExtHT: A hybrid tracing method for cyber-attacks in power industrial control systems

Yang-Rong Chen; Yu Wang; Gui-Rong Huang; Jun-E Li

doi:10.1016/j.isatra.2022.10.024

ExtHT: A hybrid tracing method for cyber-attacks in power industrial control systems

ISA Trans. 2023 May:136:1-15. doi: 10.1016/j.isatra.2022.10.024. Epub 2022 Oct 29.

Authors

Yang-Rong Chen¹, Yu Wang², Gui-Rong Huang³, Jun-E Li⁴

Affiliations

¹ Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University, Wuhan 430072, China. Electronic address: yangrong_chen@whu.edu.cn.
² Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University, Wuhan 430072, China. Electronic address: 742877588@qq.com.
³ Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University, Wuhan 430072, China. Electronic address: 609026607@qq.com.
⁴ Key Laboratory of Aerospace Information Security and Trusted Computing, Ministry of Education, School of Cyber Science and Engineering, Wuhan University, Wuhan 430072, China. Electronic address: jeli@whu.edu.cn.

PMID: 36357220
DOI: 10.1016/j.isatra.2022.10.024

Abstract

Tracing the sources of cyber-attacks in Power Industrial Control Systems (PICS) can help the defense systems to block the attacks, and support the decision of the grid control policies. However, there has been no work on the cyber-attack source traceback for PICS, and the methods for the Internet are not suitable for PICS in terms of fineness, real-time performance, and supporting communication protocols. Therefore, a method for tracing cyber-attacks in PICS is proposed. First, the communication network architecture of PICS and the cyber security threats to PICS are analyzed. Then, an extended hybrid tracing method (ExtHT) based on packet marking and packet logging is proposed. This method involves all the devices working at the data link layer and upper layers to achieve more fine-grained attack tracing. At the same time, taking the costs of attack tracing into consideration, a coarse-grained tracing mode is presented to improve the tracing speed. In addition, a log database optimization scheme is provided to reduce storage costs. To facilitate the application of this method in practice, a cyber-attack source tracing system and its deployment architecture are designed for PICS. Further, the applicability and limitations of ExtHT are analyzed, theory ratiocinations are given to justify our ExtHT, and the performance of our ExtHT is compared with that of existing mainstream methods. Finally, two cyber-attack scenarios against PICS are constructed and the feasibility of ExtHT is verified on them.

Keywords: Cyber-attack source tracing; Data link layer; Packet logging; Packet marking; Power industrial control system.