Corrupted GOOSE Detectors: Anomaly Detection in Power Utility Real-Time Ethernet Communications

Maëlle Kabir-Querrec (1, 2) , Stéphane Mocanu (1) , Pascal Bellemain (3) , Jean-Marc Thiriet (2) , Eric Savary (4)

1 GIPSA-SYSCO - GIPSA - Systèmes non linéaires et complexité
2 GIPSA-SAIGA - GIPSA - Signal et Automatique pour la surveillance, le diagnostic et la biomécanique
3 GIPSA-Services - GIPSA-Services
4 Euro-System

GOOSE protocol is used for critical protection operations in the power grid, as standardized by IEC61850. It thus has strong real-time constraints that make very hard to implement any security means for integrity and confidentiality such as encryption or signature. Our answer to this lack of dedicated cybersecurity measures is to check legitimacy of every GOOSE messages flowing over the managed network. When detectors issue an alert, the SCADA informs field devices to discard GOOSE communication and run an alternative protection strategy. This article focuses on the GOOSE attack detectors we developed: one dedicated to Ethernet storm and the other one to fraudulent GOOSE frames. The paper first introduces main GOOSE protocol mechanisms and gives a brief state of the art regarding GOOSE attack management before presenting our architecture and the detectors.

Mots clés: Cybersecurity; GOOSE; Ethernet storm; IEC61850; Spoof attack; SCADA

Domaines: Sciences de l'ingénieur [physics]

Maëlle Kabir-Querrec, Stéphane Mocanu, Pascal Bellemain, Jean-Marc Thiriet, Eric Savary. Corrupted GOOSE Detectors: Anomaly Detection in Power Utility Real-Time Ethernet Communications. GreHack 2015, Verimag, Nov 2015, Grenoble, France. ⟨hal-01237725⟩