TY - GEN
T1 - A Multi-step Attack Detection Framework for the Power System Network
AU - Yang, Ju
AU - Zhou, Liang
AU - Wang, Le
AU - Li, Shudong
AU - Lin, Ziqing
AU - Gu, Zhaoquan
N1 - Publisher Copyright:
© 2022 IEEE.
PY - 2022
Y1 - 2022
N2 - The power system is an important infrastructure that ensures social stability. With the development of information technologies, the power system has been providing more convenience with its highly digital and automatic characteristics. However, more and more network attacks against the power system network occurred, which could cause severe consequences. Hence, it is of great significance to ensure the network security of the power system. Because of attacks' high concealment and high risk, the network attack detection has become a research hotspot in recent years. This paper studies the multi-step attack detection of the the power system, and proposes a multi-step attack detection framework. First, the alarm information of different intrusion detection systems is fused for further analysis. Then the massive alarms are aggregated and correlated to construct the attack chain templates for detecting multi-step attacks. Finally, by combining spatio-temporal constraint rules, the detection of multi-step attacks can be realized.
AB - The power system is an important infrastructure that ensures social stability. With the development of information technologies, the power system has been providing more convenience with its highly digital and automatic characteristics. However, more and more network attacks against the power system network occurred, which could cause severe consequences. Hence, it is of great significance to ensure the network security of the power system. Because of attacks' high concealment and high risk, the network attack detection has become a research hotspot in recent years. This paper studies the multi-step attack detection of the the power system, and proposes a multi-step attack detection framework. First, the alarm information of different intrusion detection systems is fused for further analysis. Then the massive alarms are aggregated and correlated to construct the attack chain templates for detecting multi-step attacks. Finally, by combining spatio-temporal constraint rules, the detection of multi-step attacks can be realized.
KW - attack chain templates
KW - correlation of alarms
KW - multi-step attack detection
KW - spatio-temporal constraint rules
KW - the power system security
UR - https://www.scopus.com/pages/publications/85141436556
U2 - 10.1109/DSC55868.2022.00008
DO - 10.1109/DSC55868.2022.00008
M3 - 会议稿件
AN - SCOPUS:85141436556
T3 - Proceedings - 2022 7th IEEE International Conference on Data Science in Cyberspace, DSC 2022
SP - 1
EP - 8
BT - Proceedings - 2022 7th IEEE International Conference on Data Science in Cyberspace, DSC 2022
PB - Institute of Electrical and Electronics Engineers Inc.
T2 - 7th IEEE International Conference on Data Science in Cyberspace, DSC 2022
Y2 - 11 July 2022 through 13 July 2022
ER -