Investigation of Multi-stage Attack and Defense Simulation for Data Synthesis (2312.13697v1)
Abstract: The power grid is a critical infrastructure that plays a vital role in modern society. Its availability is of utmost importance, as a loss can endanger human lives. However, with the increasing digitalization of the power grid, it also becomes vulnerable to new cyberattacks that can compromise its availability. To counter these threats, intrusion detection systems are developed and deployed to detect cyberattacks targeting the power grid. Among intrusion detection systems, anomaly detection models based on machine learning have shown potential in detecting unknown attack vectors. However, the scarcity of data for training these models remains a challenge due to confidentiality concerns. To overcome this challenge, this study proposes a model for generating synthetic data of multi-stage cyber attacks in the power grid, using attack trees to model the attacker's sequence of steps and a game-theoretic approach to incorporate the defender's actions. This model aims to create diverse attack data on which machine learning algorithms can be trained.
- T. Krause et al., “Cybersecurity in power grids: challenges and opportunities,” Sensors, 2021.
- D. U. Case, “Analysis of the cyber attack on the ukrainian power grid,” E-ISAC, 2016.
- L. Bader et al., “Comprehensively analyzing the impact of cyberattacks on power grids,” Euro S&P, 2023.
- J. McHugh, “Intrusion and intrusion detection,” IJIS, 2001.
- I. Sharafaldin et al., “Toward generating a new intrusion detection dataset and intrusion traffic characterization.” ICISSp, 2018.
- C. G. Cordero et al., “On generating network traffic datasets with synthetic attacks for intrusion detection,” ACM TOPS, 2021.
- S. K. Pandey et al., “Gan-based data generation approach for ids: Evaluation on decision tree,” in AISC: V14, 2021.
- V. Babu et al., “Melody: synthesized datasets for evaluating intrusion detection systems for the smart grid,” in WSC, 2017.
- A. Dutta et al., “Deep reinforcement learning for cyber system defense under dynamic adversarial uncertainties,” arXiv preprint arXiv:2302.01595, 2023.
- D. Agnew et al., “Implementation aspects of smart grids cyber-security cross-layered framework for critical infrastructure operation,” Applied Sciences, 2022.
- S. Musman et al., “A game theoretic approach to cyber security risk management,” JDMS, 2018.
- X. Ou et al., “Mulval: A logic-based network security analyzer.” in USENIX, 2005.
- B. E. Strom et al., “Mitre att&ck: Design and philosophy,” in Technical report, 2018.
- P. E. Kaloroumakis et al., “Toward a knowledge graph of cybersecurity countermeasures,” MITRE, 2021.
- E. W. Dijkstra, “A note on two problems in connexion with graphs,” in Edsger Wybe Dijkstra: His Life, Work, and Legacy, 2022.
- Y. Cherdantseva et al., “A review of cyber security risk assessment methods for scada systems,” Computers & security, 2016.
- A. Zieger et al., “The β𝛽\betaitalic_β-time-to-compromise metric for practical cyber security risk estimation,” in IMF. IEEE, 2018.
- T. J. Williams, “The purdue enterprise reference architecture,” Computers in industry, 1994.
- K. Sinan et al., “A novel hybrid approach to estimate customer interruption costs for industry sectors,” Engineering, 2013.
- H. Au et al., “Multi-stage analysis of intrusion detection logs for quick impact assessment,” in ECIW, 2016.
- T. Saranya et al., “Performance analysis of machine learning algorithms in intrusion detection system: A review,” Procedia Computer Science, 2020.
- J. W. Teo et al., “Evaluating synthetic datasets for training machine learning models to detect malicious commands,” in SmartGridComm. IEEE, 2022.
- A. Kelly et al., “Investigating the statistical assumptions of naïve bayes classifiers,” in CISS. IEEE, 2021.
- H. Liu et al., “Machine learning and deep learning methods for intrusion detection systems: A survey,” applied sciences, 2019.