In the analysis of coordinated network attacks on electric power cyber-physical system (CPS), it is difficult to restore the complete attack path, and the intent of the attack cannot be identified automatically. A method is therefore proposed for the extracting patterns of coordinated network attacks on electric power CPS based on temporal-topological correlation. First, the attack events are aggregated according to the alarm log of the cyber space, and a temporal-causal Bayesian network-based cyber attack recognition algorithm is proposed to parse out the cyber attack sequences of the same attacker. Then, according to the characteristic curves of different attack measurement data in physical space, a combination of physical attack event criteria algorithm is designed to distinguish the types of physical attack events. Finally, physical attack events and cyber attack sequences are matched via temporal-topological correlation, frequent patterns of attack sequences are extracted, and hidden multi-step attack patterns are found from scattered grid measurement data and information from alarm logs. The effectiveness and efficiency of the proposed method are verified by the testbed at Mississippi State University.
@article{arxiv.2003.10440,
title = {Method for Extracting Patterns of Coordinated Network Attacks on Electric Power CPS based on Temporal-Topological Correlation},
author = {Lei Wang and Zhaoyang Qu and Yang Li and Kewei Hu and Jian Sun and Kai Xue and Mingshi Cui},
journal= {arXiv preprint arXiv:2003.10440},
year = {2020}
}