QUALITY OF SERVICE INDICATORS UNDER CYBER ATTACKS BY RAO SIMULATOR

Transcription

1 QUALITY OF SERVICE INDICATORS UNDER CYBER ATTACKS BY RAO SIMULATOR Multitel (S.Iassinovski) Multitel Research Center Parc Initialis, rue Pierre et Marie Curie n 2 B-7000 Mons, Belgium iassinovski@multitel.be

2 What do we need to model and simulate? Electrical infrastructure (our reference scenario fragment of MV distribution grid supplied by Zuriel feeder of TF HV/MV substation) Communication infrastructure and SCADA RTUs and switches SCADA procedures (our reference scenario fault isolation and system restoration (FISR) process) Cyber attacks QoS indicators (estimation of damage) Risk = probability * damage 2 CockpitCI Workshop, Rome, 16/12/2014

3 ECI: Reference scenario fragment Zuriel feeder of TF substation 3 CockpitCI Workshop, Rome, 16/12/2014

4 Information and telecommunication CI 4 CockpitCI Workshop, Rome, 16/12/2014

5 IEC SCADA control center 5 CockpitCI Workshop, Rome, 16/12/2014

6 CockpitCI reference scenario: FISR + cyber attack 6 CockpitCI Workshop, Rome, 16/12/2014

7 Intelligent RAO simulator A lot of domain specific simulators exists (electric, telecom), but not heterogeneous So we need a general-purpose simulator We use the Intelligent RAO simulator, a hybrid tool based on artificial intelligence for on line and off line optimisation and decision making RAO is: A discrete-event simulator An expert system engine An optimization tool (state graph search) A data driven programming tool 7 CockpitCI Workshop, Rome, 16/12/2014

8 RAO: structure Messages (External events) Messages processing Irregular events simulation Dynamic production system Inference engine Knowledge base activities decision points Events processing Events list State graph search Data base objects Process building Performance indicators Animation Tracing 8 CockpitCI Workshop, Rome, 16/12/2014

9 CCI/SCADA modeling under cyber attack: Messages and routes Commands/Information flow Electric grid (substations, poles, lines) RTU RTU RTU SCADA + CCI network elements Messages Routes over links Human-Machine Interface 9 CockpitCI Workshop, Rome, 16/12/2014

10 CCI/SCADA modeling under cyber attack: Compromised element behavior Unchanged message (70%) Compromised message (25%) Lost message (5%) Incoming message (100%) 10 CockpitCI Workshop, Rome, 16/12/2014

11 CCI/SCADA modeling under cyber attack: Cyber attack scenario Electric grid (substations, poles, lines) RTU RTU RTU SCADA + CCI network elements Cyber attack Cyber attack: a time series of element state rankings Time Element Up Degraded Down 1 29 (GW prime) (FIU) (FIU) (RTU 1) (GW prime) Cyber attack flow Human-Machine Interface 11 CockpitCI Workshop, Rome, 16/12/2014

12 CCI/SCADA modeling under cyber attack: Fault localization scenario Step1 open switch 435R close breaker on Zuriel feeder Step 2 open switch 641B/R close switch 435R Step 3 open switch 622R:A open switch 48/635R close switch 641B/R Step 4 close switch 48/635R Step 5 open switch 622R:B close switch 622R:A Step 6 open switch 78/266R close switch 622R:B 12 CockpitCI Workshop, Rome, 16/12/2014

13 The QoS under cyber attack RAO simulation model Consists of: Data base: a set of objects describing system composition and state 223 permanent objects + temporary objects created while simulating) belonging to 20 object types (substation, breaker, line, FIU, gateway, SCADA, message, route, etc.) Knowledge base: a set of activities describing system behaviour 211 activities of 103 types (toggle breaker state, send a message, repair a line, transmit a message, etc.) Animation description to illustrate system state 5 main screens Quality of service indicators and specific technical indicators definition Tn, SAIDI, SAIFI, CAIDI About 1000 specific technical indicators for different elements of the system 13 CockpitCI Workshop, Rome, 16/12/2014

14 ECI distribution greed (reference FISR scenario) Current load Faulty line feeders Grid node with RTU Customer HV-MV substation 14 CockpitCI Workshop, Rome, 16/12/2014

15 CCI/SCADA elements with state rankings animation screen 15 CockpitCI Workshop, Rome, 16/12/2014

16 Reference scenario on different segments no cyber attack Tn is an equivalent full load loss time Segment number Indicator Duration, min Tn, min Customer % 45.5% 0% 46.2% 50% 86.5% 56.3% Customer % 0% 50% 53.8% 57.1% 88.5% 62.5% Customer % 45.5% 41.7% 38.5% 35.7% 9.6% 0% Customer % 45.5% 41.7% 38.5% 35.7% 0% 37.5% Commands sent Delivery time, min CockpitCI Workshop, Rome, 16/12/2014

17 Reference scenario on different segments cyber attack on Radio VHF Unit 1 Cyber attack scenario: Time Element Up Degraded Down 0 2 (Radio VHF Unit 1) Segment number Indicator Duration, min Tn, min Customer % 38.9% 0% 31.3% 45% 78% 45% Customer % 0% 45% 43.8% 55% 81.4% 55% Customer % 38.9% 35% 31.3% 35% 11.9% 0% Customer % 38.9% 35% 31.3% 35% 3.4% 35% Commands sent Delivery time, min CockpitCI Workshop, Rome, 16/12/2014

18 Reference scenario on different segments cyber attack on Radio VHF Unit 2 Cyber attack scenario: Time Element Up Degraded Down 0 3 (Radio VHF Unit 2) Segment number Indicator Duration, min Tn, min Customer % 45.5% 0% 45% 50% 82% 55% Customer % 0% 62.5% 60% 63.6% 86.9% 70% Customer % 45.5% 43.8% 35% 31.8% 11.5% 0% Customer % 45.5% 43.8% 35% 31.8% 0% 25% Commands sent Delivery time, min CockpitCI Workshop, Rome, 16/12/2014

19 Reference scenario on different segments cyber attack on Radio VHF Units 1 and 2 Cyber attack scenario: Time Element Up Degraded Down 0 2 (Radio VHF Unit 1) (Radio VHF Unit 2) Segment number Indicator Duration, min Tn, min Customer % 38.9% 0% 40.9% 45.8% 79.4% 54.2% Customer % 0% 45% 50% 54.2% 82.5% 62.5% Customer % 38.9% 35% 31.8% 29.2% 11.1% 0% Customer % 38.9% 35% 31.8% 29.2% 0% 29.2% Commands sent Delivery time, min CockpitCI Workshop, Rome, 16/12/2014

20 Reference scenario on different segments dynamic cyber attack on Radio VHF Units 1 and 2 Cyber attack scenario: Indicator Time Element Up Degraded Down 6 2 (Radio VHF Unit 1) (Radio VHF Unit 2) (Radio VHF Unit 1) (Radio VHF Unit 1) Segment number Duration, min Tn, min Customer % 41.2% 0% 42.9% 47.8% 80.6% 56.5% Customer % 0% 52.9% 52.4% 56.5% 83.9% 65.2% Customer % 41.2% 41.2% 33.3% 30.4% 11.3% 0% Customer % 58.8% 41.2% 33.3% 30.4% 0% 30.4% Commands sent Delivery time, min CockpitCI Workshop, Rome, 16/12/2014

21 Reference scenario on different segments dynamic cyber attack on Radio VHF Units 1 and 2 Cyber attack scenario: Indicator Time Element Up Degraded Down 6 2 (Radio VHF Unit 1) (Radio VHF Unit 2) (Radio VHF Unit 1) (Radio VHF Unit 1) Segment number Duration, min Tn, min Customer % 82.1% 22% 42.9% 81.5% 81.5% 85.1% Customer % 37.5% 86.4% 52.4% 84.6% 84% 88.1% Customer % 82.1% 83% 33.3% 15.4% 19.8% 0% Customer % 82.1% 83% 33.3% 15.4% 11.1% 14.9% Commands sent Delivery time, min CockpitCI Workshop, Rome, 16/12/2014

22 Monte-Carlo simulations, static security state Cyber state scenario: Element Up Degraded Down Number of simulations: 500 Indicator: Tn Segment number Tn, min ( true ) Tn, min (simulation) Confidence interval, α = 0.05 Confidence interval, % Difference with true value, % 1 (FIU_MOSCAD_local) (FIU_MOSCAD_remote ) CockpitCI Workshop, Rome, 16/12/2014

23 Monte-Carlo simulations, dynamic security state Cyber state scenario: Time Element Up Degraded Down 0 20 (TF_Zuriel) Number of simulations: 200 Indicator: Tn Segment number Tn, min (true) Tn, min (simulation) Confidence interval, α = 0.05 Confidence interval, % Difference with true value, % 8 3 (Radio_VHF_Unit_2) (Radio_VHF_Unit_1) % 2.41% 2.11% 9.47% 7.35% 2.75% 6.85% 0.0% 0.39% 0.80% 4.13% 2.61% 0.88% 2.29% 23 CockpitCI Workshop, Rome, 16/12/2014

24 Conclusion Developed modeling framework and implemented simulation model have proven the feasibility of QoS indicators (damage) calculation for such a complex heterogeneous system under cyber attack The input/output data of the model are clearly identified, so the model can be integrated in the whole CockpitCI tool, making a part of Integrated Risk Predictor 24 CockpitCI Workshop, Rome, 16/12/2014

25 Any question?

26 Thank you for your attention