Analysing and modelling worm propagation speed in the smart grid communication infrastructure

Abstract

In an advanced metering infrastructure (AMI), smart meters may communicate in an ad-hoc fashion to perform functionalities like remote metering and demand response. However, the AMI is susceptible to cyber-physical threats caused by malware such as worms. In this work, we derive a probabilistic model for worm propagation in the AMI. The accuracy of the model is validated using three worm propagation scenarios. This model can be used to estimate the time required to infect N meters in the AMI based on the worm propagation technique deployed by the attacker. In addition, we use the derived model to investigate the sensitivity of worm propagation to different parameters such as transmission range, worm size, number and location of target meters. We also demonstrate how an attacker can improve the propagation speed of the worm by modifying the worm's target list. The latter is done by comparing the three introduced propagation scenarios. Improving the worm's propagation speed can amplify the possible physical consequence of the attack.