Supervisory Control And Data Acquisition Networks Research Articles

Multi-Stage Learning Framework Using Convolutional Neural Network and Decision Tree-Based Classification for Detection of DDoS Pandemic Attacks in SDN-Based SCADA Systems

Supervisory Control and Data Acquisition (SCADA) systems, which play a critical role in monitoring, managing, and controlling industrial processes, face flexibility, scalability, and management difficulties arising from traditional network structures. Software-defined networking (SDN) offers a new opportunity to overcome the challenges traditional SCADA networks face, based on the concept of separating the control and data plane. Although integrating the SDN architecture into SCADA systems offers many advantages, it cannot address security concerns against cyber-attacks such as a distributed denial of service (DDoS). The fact that SDN has centralized management and programmability features causes attackers to carry out attacks that specifically target the SDN controller and data plane. If DDoS attacks against the SDN-based SCADA network are not detected and precautions are not taken, they can cause chaos and have terrible consequences. By detecting a possible DDoS attack at an early stage, security measures that can reduce the impact of the attack can be taken immediately, and the likelihood of being a direct victim of the attack decreases. This study proposes a multi-stage learning model using a 1-dimensional convolutional neural network (1D-CNN) and decision tree-based classification to detect DDoS attacks in SDN-based SCADA systems effectively. A new dataset containing various attack scenarios on a specific experimental network topology was created to be used in the training and testing phases of this model. According to the experimental results of this study, the proposed model achieved a 97.8% accuracy rate in DDoS-attack detection. The proposed multi-stage learning model shows that high-performance results can be achieved in detecting DDoS attacks against SDN-based SCADA systems.

Ensemble Learning Framework for DDoS Detection in SDN-Based SCADA Systems.

Supervisory Control and Data Acquisition (SCADA) systems play a crucial role in overseeing and controlling renewable energy sources like solar, wind, hydro, and geothermal resources. Nevertheless, with the expansion of conventional SCADA network infrastructures, there arise significant challenges in managing and scaling due to increased size, complexity, and device diversity. Using Software Defined Networking (SDN) technology in traditional SCADA network infrastructure offers management, scaling and flexibility benefits. However, as the integration of SDN-based SCADA systems with modern technologies such as the Internet of Things, cloud computing, and big data analytics increases, cybersecurity becomes a major concern for these systems. Therefore, cyber-physical energy systems (CPES) should be considered together with all energy systems. One of the most dangerous types of cyber-attacks against SDN-based SCADA systems is Distributed Denial of Service (DDoS) attacks. DDoS attacks disrupt the management of energy resources, causing service interruptions and increasing operational costs. Therefore, the first step to protect against DDoS attacks in SDN-based SCADA systems is to develop an effective intrusion detection system. This paper proposes a Decision Tree-based Ensemble Learning technique to detect DDoS attacks in SDN-based SCADA systems by accurately distinguishing between normal and DDoS attack traffic. For training and testing the ensemble learning models, normal and DDoS attack traffic data are obtained over a specific simulated experimental network topology. Techniques based on feature selection and hyperparameter tuning are used to optimize the performance of the decision tree ensemble models. Experimental results show that feature selection, combination of different decision tree ensemble models, and hyperparameter tuning can lead to a more accurate machine learning model with better performance detecting DDoS attacks against SDN-based SCADA systems.

Unknown Attack Traffic Classification in SCADA Network Using Heuristic Clustering Technique

Attack Traffic Classification (ATC) technique is an essential tool for Industrial Control System (ICS) network security, which can be widely used in active defense, situational awareness, attack source traceback and so on. At present, the state-of-the-art ATC methods are usually based on traffic statistical features and machine learning techniques, including supervised classification methods and unsupervised clustering methods. However, it is difficult for these methods to overcome the problems of lack of attack samples and high real-time requirement in ATC in Supervisory Control and Data Acquisition (SCADA) networks. In order to address the above problems, we propose a self-growing ATC model based on a new density-based heuristic clustering method, which can continuously and automatically detect and distinguish different kinds of unknown attack traffic generated by various attack tools against SCADA networks in real time. An effective representation method of SCADA network traffic is proposed to further improve the performance of ATC. In addition, a large number of experiments are conducted on a compound dataset consisting of the SCADA network dataset, the attack tool dataset and the ICS honeypot dataset, to evaluate the proposed method. The experimental results show that the proposed method outperforms existing state-of-the-art ATC methods in the crucial situation of only normal SCADA network traffic.

Agnostic CH-DT Technique for SCADA Network High-Dimensional Data-Aware Intrusion Detection System

The pervasiveness in the industrial internet of things (IIoT) due to the application of supervisory control and data acquisition (SCADA) has led to the growth of heterogeneous sensor data, thereby increasing the risk of intrusions and attacks. The existence and effect of intruders and their innovative attack techniques are on the rise. Existing intrusion detection systems (IDS) tend to be computationally expensive with this form of data due to the presence of noise. In real-time domains, available methods lag, necessitating additional research into effective feature extraction schemes, which is fundamental in machine learning (ML) for time exigency. This study, in a comparative analysis of some feature selection techniques (FS), proposes a combination of an efficient ML classifier and an agnostic feature selection (FS) scheme for attack detection and classification in a real-time SCADA network. The flexibility and interoperability of the proposed approach resolve the computational complexity of vulnerability detection schemes while reducing false alarm rates (FAR) and overall model execution time. With the view of an online preprocessing, the proposed technique is phased thus: (i) data preparatory consisting of data cleansing and normalization followed by (ii) the combination of a pre-pruned decision tree (DT) algorithm and an agnostic Chi-square FS approach built to obtain an optimal subset of data features for efficient IDS. (iii) Evaluation of proposed agnostic DT-CH and other FS candidates for anomaly detection.

Protocol study and anomaly detection for server-driven traffic in SCADA networks

Attacks against Supervisory Control and Data Acquisition (SCADA) systems operating critical infrastructures have largely appeared in the past decades. There are several anomaly detection systems that model the traffic of request–response mechanisms, where a client initiates a request to a server and the server sends back a response later. However, many modern SCADA protocols also allow server-driven traffic without a paired request, and anomaly detection for server-driven traffic has not been well-studied. This paper provides a comprehensive understanding of server-driven traffic across different protocols, such as MMS, Siemens S7, S7-plus, and IEC 60870-5-104 (IEC-104), with traffic analysis. The analysis results show that the common postulation of periodicity and correlation within SCADA traffic holds true for most of the analyzed datasets. The paper then proposes a Multivariate Correlation Anomaly Detection (MCAD) approach for server-driven traffic that presents complicated correlations among flows. The proposed approach is compared with a univariate correlation anomaly detection approach designed for SCADA and a general purpose anomaly detection approach based on neural network techniques. These approaches are tested with an IEC-104 dataset from a real power utility with injected timing perturbations resulting from a Stuxnet-like stealthy attack scenario. The detection accuracy of MCAD outperforms the compared methods and the time-to-detection performance is promising.

Design of Efficient Based Artificial Intelligence Approaches for Sustainable of Cyber Security in Smart Industrial Control System

Online food security and industrial environments and sustainability-related industries are highly confidential and in urgent need for network traffic analysis to attain proper security information to avoid attacks from anywhere in the world. The integration of cutting-edge technology such as the Internet of things (IoT) has resulted in a gradual increase in the number of vulnerabilities that may be exploited in supervisory control and data acquisition (SCADA) systems. In this research, we present a network intrusion detection system for SCADA networks that is based on deep learning. The goal of this system is to defend ICSs against network-based assaults that are both conventional and SCADA-specific. An empirical evaluation of a number of classification techniques including k-nearest neighbors (KNN), linear discriminant analysis (LDA), random forest (RF), convolution neural network (CNN), and integrated gated recurrent unit (GRU) is reported in this paper. The suggested algorithms were tested on a genuine industrial control system (SCADA), which was known as the WUSTL-IIoT-2018 and WUSTL-IIoT-20121 datasets. SCADA system operators are now able to augment proposed machine learning and deep learning models with site-specific network attack traces as a result of our invention of a re-training method to handle previously unforeseen instances of network attacks. The empirical results, using realistic SCADA traffic datasets, show that the proposed machine learning and deep-learning-based approach is well-suited for network intrusion detection in SCADA systems, achieving high detection accuracy and providing the capability to handle newly emerging threats. The accuracy performance attained by the KNN and RF algorithms was superior and achieved a near-perfect score of 99.99%, whereas the CNN-GRU model scored an accuracy of 99.98% using WUSTL-IIoT-2018. The Rf and GRU algorithms achieved >99.75% using the WUSTL-IIoT-20121 dataset. In addition, a statistical analysis method was developed in order to anticipate the error that exists between the target values and the prediction values. According to the findings of the statistical analysis, the KNN, RF, and CNN-GRU approaches were successful in achieving an R2 > 99%. This was demonstrated by the fact that the approach was able to handle previously unknown threats in the industrial control systems (ICSs) environment.

SCADA intrusion detection scheme exploiting the fusion of modified decision tree and Chi-square feature selection

The industrial internet of things (IIoT) and supervisory control and data acquisition (SCADA) have experienced ubiquitous growth recently. This growth comes with the challenge of an increased number of unusual attacks constituting threats. The existence and effect of intruders and their innovative attack techniques are rising. Although the existing intrusion detection systems (IDS) safeguard the networks, they have been computationally expensive. In real-time domains, available methods lag, necessitating additional research into effective feature extraction schemes with time exigency. An IDS with a fused feature selection (FS) approach for detecting and classifying attacks in a real-time SCADA network is imperative. It is to enable the resolution of computationally complex vulnerability detection schemes. The proposed technique is in three (3) phases: (a) data preparation which involves data cleansing and normalization, and (b) a fused feature selection approach built to obtain an optimal subset of features using Chi-square. (c) deployment of the modified decision tree (MDT) for anomaly detection and classification. Lastly, the reliability of the proposed model was validated, demonstrating suitability in precisely detecting abnormalities while minimizing computational time. This improvement enables adaptability for the IDS deployment scheme in a real-time situation, which could be in the control center. The validation results reveal that when the proposed chi-square-based (fused) feature extraction is employed, it performs optimally to other FS techniques and ML classifiers, compared across four (4) publicly available datasets. Cohen’s kappa coefficient (CKC) further validates the proposed model’s reliability. Further demonstrating the experimental results with recourse to false positive rates (FPR), the Mathews correlation coefficient (MCC) was employed. It also shows the resilience of the proposed model performance on an imbalanced dataset validating its suitability in real scenarios.

Improving anomaly detection in SCADA network communication with attribute extension

Network anomaly detection for critical infrastructure supervisory control and data acquisition (SCADA) systems is the first line of defense against cyber-attacks. Often hybrid methods, such as machine learning with signature-based intrusion detection methods, are employed to improve the detection results. Here an attempt is made to enhance the support vector-based outlier detection method by leveraging behavioural attribute extension of the network nodes. The network nodes are modeled as graph vertices to construct related attributes that enhance network characterisation and potentially improve unsupervised anomaly detection ability for SCADA network. IEC 104 SCADA protocol communication data with good domain fidelity is utilised for empirical testing. The results demonstrate that the proposed approach achieves significant improvements over the baseline approach (average F_{1} score increased from 0.6 to 0.9, and Matthews correlation coefficient (MCC) from 0.3 to 0.8). The achieved outcome also surpasses the unsupervised scores of related literature. For critical networks, the identification of attacks is indispensable. The result shows an insignificant missed-alert rate (0.3% on average), the lowest among related works. The gathered results show that the proposed approach can expose rouge SCADA nodes reasonably and assist in further pruning the identified unusual instances.

IMPLEMENTING INTERNET PROTOCOL (IP) BASED SUPERVISORY CONTROL AND DATA ACQUISITION (SCADA) NETWORK SYSTEM

SCADA (supervisory control and data acquisition) is a system that monitors and control industrial, infrastructure, or facility- based processes. Scada systems integrate data acquisition systems with data transmission systems and graphical software in order to provide a centrally located "monitor and control" system for numerous process inputs and outputs. The sensors and metering devices are connected to field control devices. These control devices take real-world physical input signals from the sensors and, convert the signals to digital data and make decisions based on programmed logic or commands from the system operators. The control devices are connected control room environments where the hmi software systems are used by system operators to interact withthe control devices. IP SCADA is a plug and play feature in the IDP 600 terminal series that allow common SACDA devices such as remote terminal units (RTU) and PLC to be connected to SCADA networks using the IsatData Pro satellite service. IP SCADA is well suited for SCADA devices that are located in remote sites where other communication services are unavailable, unreliable or cost prohibitive and for sites that have low data usage requirements. IP-based SCADA Network systems provides many benefits like Unlimited locations for servers and clients, Service takeover and remote support, Data saving & Global Coverage.

Integrating Industrial Appliances for Security Enhancement in Data Point Using SCADA Networks with Learning Algorithm

The process of ensuring automatic operation for industrial appliances using both supervision and control techniques is a challenging task. Therefore, this article focuses on implementing Supervisory Control and Data Acquisition (SCADA) for controlling all industrial appliances. The design process of implementation case is performed using an analytical framework by examining the primary energy sources at the initial state; thus, a smart network is supported. The designed mathematical model is integrated with a learning technique that allocates resources at proper quantities. Further, the complex manual tuning of individual appliances is avoided in the projected method as the input variables are driven in a direct way at reduced loss state. In addition, the data processing state of individual appliances is carried out using central data controller where all parametric values are stored. In case any errors are observed, then SCADA network fixes the error in an automated way, reducing end-to-end delays in all appliances. To validate the effectiveness of the proposed method, five scenarios are examined and simulated where outcomes prove that SCADA network using learning models provides optimal results on an average of 84 percent as compared to the existing models without learning algorithm.

Securing SCADA Energy Management System under DDos Attacks Using Token Verification Approach

The advanced connection requirements of industrial automation and control systems have sparked a new revolution in the Industrial Internet of Things (IIoT), and the Supervisory Control and Data Acquisition (SCADA) network has evolved into an open and highly interconnected network. In addition, the equipment of industrial electronic devices has experienced complete systemic integration by connecting with the SCADA network, and due to the control and monitoring advantages of SCADA, the interconnectivity and working efficiency among systems have been tremendously improved. However, it is inevitable that the SCADA system cannot be separated from the public network, which indicates that there are concerns over cyber-attacks and cyber-threats, as well as information security breaches, in the SCADA network system. According to this context, this paper proposes a module based on the token authentication service to deter attackers from performing distributed denial-of-service (DDoS) attacks. Moreover, a simulated experiment has been conducted in an energy management system in the actual field, and the experimental results have suggested that the security defense architecture proposed by this paper can effectively improve security and is compatible with real field systems.

Smart Grid Security by Embedding S-Box Advanced Encryption Standard

Supervisory control and data acquisition (SCADA) systems continuously monitor the real-time processes in the smart grid. The system software, which is based on a human-machine interface (HMI), makes intelligent decisions to assist the system operator and perform normal grid management activities. The management of SCADA networks and monitoring without proper security is a major concern, as many grids and plant networks still lack necessary monitoring and detection systems, making them vulnerable to attack. SCADA networks exploit physical weaknesses as well as cyber-attacks. Researchers have developed a monitoring system based on a field-programmable gate array (FPGA) and a microcontroller that allows for faster timing and system response. The cryptography-based substitution box (S-box) Advanced Encryption Standard (AES) and decryption method were proposed in the research paper, which may be merged with smart grid communication hardware and grid distribution as an integrated chip, synthesized on FPGA-Virtex-5 hardware. The method creates a platform for grid security by implementing a cryptographic-based security algorithm in hardware chips. The algorithm was designed using VHDL coding in Xilinx ISE 14.7 software and tested with various grid data sizes and key. The research represents a significant effort on the part of the businesses looking for solutions to secure the smart grid and plants by incorporating secure hardware.

Moving Target Defense Based on Adaptive Forwarding Path Migration for Securing the SCADA Network

Static characteristics of supervisory control and data acquisition (SCADA) system are often exploited to perform malicious activities on smart grids. Most of the time, the success of cyberattacks begins with the profiling of the target system and follows by the analysis of the limited resources. To alleviate the asymmetry between attack and defense, network-based moving target defense (MTD) techniques have been applied in the network system to defend against cyberattacks by constructing a dynamic attack surface to the adversary. In this paper, we propose a novel MTD technique based on adaptive forwarding path migration (AFPM) that focuses on improving the defense capability and optimizing the network performance of path mutation. Considering the transient problems present in path mutation caused by the dynamic switching of the forwarding path, we formalize the mutation constraints based on the satisfiability modulo theory (SMT) to select the mutation path. Considering the limited defense capability of path mutation owing to the traditional mutation selection mechanism, we design the mutation path generation algorithm based on the network security capacity matrix to obtain an optimal combination of mutation path and mutation period. Finally, we compare and analyze various cyber defense techniques used in the SCADA network and demonstrate experimentally that our MTD technique can prevent more than 92% of passive monitoring under specified conditions while ensuring the quality of service (QoS) to be almost the same as the static network.

Study on the intelligent honeynet model for containing the spread of industrial viruses

The honeynet, as a promising technology, is increasingly used to actively discover novel network viruses in order to provide more effective defense strategies for the protected network in advance. The state-of-the-art network models aim to investigate the mutual effect between the honeynet and the protected network, however they have not fully exploited the potential of the intelligent honeynet. Compared with the conventional honeynet, the intelligent honeynet has made great progress in data control, data analysis, dynamic deployment, etc., which can provide more valuable information and flexible defense mechanisms for network defenders. In this paper, we propose a novel mathematical model of the intelligent honeynet to explore and prevent the propagation of industrial viruses in the Supervisory Control and Data Acquisition (SCADA) network. Through combining the intelligent honeynet with some traditional defense measures, we present a comprehensive and practical defense mechanism for the SCADA network, which can provide active and dynamic system-level and network-level defense. A theoretical analysis is provided to obtain the virus-free and virose equilibriums and demonstrate the locally and globally asymptotic stabilities of the proposed model. Moreover, A large number of numerical experiments are conducted to confirm the theoretical analysis and the superior defense performance of the proposed defense mechanism over the existing models.

The trends of supervisory control and data acquisition security challenges in heterogeneous networks

<p>Supervisory control and data acquisition (SCADA) has an important role in communication between devices in strategic industries such as power plant grid/network. Besides, the SCADA system is now open to any external heterogeneous networks to facilitate monitoring of industrial equipment, but this causes a new vulnerability in the SCADA network system. Any disruption on the SCADA system will give rise to a dangerous impact on industrial devices. Therefore, deep research and development of reliable intrusion detection system (IDS) for SCADA system/network is required. Via a thorough literature review, this paper firstly discusses current security issues of SCADA system and look closely benchmark dataset and SCADA security holes, followed by SCADA traffic anomaly recognition using artificial intelligence techniques and visual traffic monitoring system. Then, touches on the encryption technique suitable for the SCADA network. In the end, this paper gives the trend of SCADA IDS in the future and provides a proposed model to generate a reliable IDS, this model is proposed based on the investigation of previous researches. This paper focuses on SCADA systems that use IEC 60870-5-104 (IEC 104) protocol and distributed network protocol version 3 (DNP3) protocol as many SCADA systems use these two protocols.</p>

TTAS: Trusted Token Authentication Service of Securing SCADA Network in Energy Management System for Industrial Internet of Things.

The vigorous development of the Industrial Internet of Things brings the advanced connection function of the new generation of industrial automation and control systems. The Supervisory Control and Data Acquisition (SCADA) network is converted into an open and highly interconnected network, where the equipment connections between industrial electronic devices are integrated with a SCADA system through a Modbus protocol. As SCADA and Modbus are easily used for control and monitoring, the interconnection and operational efficiency between systems are highly improved; however, such connectivity inevitably exposes the system to the open network environment. There are many network security threats and vulnerabilities in a SCADA network system. Especially in the era of the Industrial Internet of Things, any security vulnerability of an industrial system may cause serious property losses. Therefore, this paper proposes an encryption and verification mechanism based on the trusted token authentication service and Transport Layer Security (TLS) protocol to prevent attackers from physical attacks. Experimentally, this paper deployed and verified the system in an actual field of energy management system. According to the experimental results, the security defense architecture proposed in this paper can effectively improve security and is compatible with the actual field system.

An Integral Data Gathering Framework for Supervisory Control and Data Acquisition Systems in Green IoT

In Green Internet of Things, energy consumption research is a hot topic. Our research focuses on Supervisory Control And Data Acquisition (SCADA) system, and it is a system consisting of a plurality of self-organized sensing networks. Live data gathering from numerous Sub-connected SCADA (S-SCADA) networks to make unified decisions based on collected data is one of pivot problem, which has not been well studied. In this article, an integral data-gathering framework is proposed to prolong network lifetime by using sink rotating and Unmanned Aerial Vehicles (UAV) path planning. In the proposed Sink Rotating joint UAV Data Gathering (SR-UAV-DG) framework, the data gathering process is divided into two organic components: (a) S-SCADA in-network data collection. The energy consumption of the network is balanced by selecting the node with the least energy consumption as the sink node. (b) Use UAV for data collection between S-SCADA networks. The theoretical analysis results show that the SR-UAV-DG framework proposed in this article reduces the maximum energy consumption of nodes in the network by 99.21% after 1000 rounds of data. The flight time of UAV is reduced by 16.83%. In the case of unreliable communication links, the data reception rate is guaranteed to reach 91.94%.

The Future of Plunger Lift Control Using Artificial Intelligence

This article, written by JPT Technology Editor Chris Carpenter, contains highlights of paper SPE 201132, “The Future of Plunger Lift Control Using Artificial Intelligence,” by Ferdinand Hingerl and Brian Arnst, SPE, Ambyint, and David Cosby, SPE, Shale Tec, et al., prepared for the 2020 SPE Virtual Artificial Lift Conference and Exhibition - Americas, 10-12 November. The paper has not been peer reviewed. Dozens of plunger lift control algorithms have been developed to account for different well conditions and optimization protocols. However, challenges exist that prevent optimization at scale. To address these challenges, a plunger lift optimization software was developed. One aspect of this software is enabling set-point optimization at scale. This paper will present the methodology to do so, detailing three separate areas working in unison to offer significant value to plunger lift well operators. Introduction Even in vertical wells, plunger lift presents significant challenges to optimization. Despite their mechanical simplicity, plunger lifted wells produce large amounts of data, and the combinations of possible set points to optimize the well are many. Additionally, plunger lift wells can present a variety of different types of anomalies and problems that require a robust understanding of the underlying physics and mathematics. Such problems then are amplified when applied to horizontal well applications. The underlying physics and mathematics applied throughout the years for vertical wells do not produce accurate results for horizontal wells. Additionally, the anomalies produced in horizontal wells are more complex. Finally, typical production engineers and well optimizers now regularly look after more than 150—and often more than 500—wells, creating additional resource constraints to optimizing a field of plunger lift wells. The presented plunger lift optimization software was implemented by creating a secure connection between the operator’s supervisory control and data acquisition (SCADA) network and the cloud. As new data are generated by the SCADA network, they are automatically transmitted to the cloud and processed. Plunger Lift Control Algorithm Overview These algorithms are the software code that determines when the well opens and when the well closes. Even though the algorithms only control well open/close, the plunger moves through four stages of plunger operation to complete one cycle: plunger fall time, casing pressure build time, plunger rise, and after flow (or production). Optimizing each individual stage is critical to ideal well production. Plunger fall time is the time required for the plunger to descend from the lubricator to the bottomhole assembly (BHA). Currently, operators use the manufacturer’s anticipated fall time, trial and error, previous knowledge, acoustical plunger tracking, and plunger fall applications to set the appropriate fall time in the controller. A “fudge factor” is often applied to help ensure that the fall timer does not expire before the plunger reaches the BHA. Plunger fall time is affected by many changing variables: plunger condition, tubing condition, liquid height, and gas and liquid density. These variables make it difficult for a fall timer set once to represent accurately the correct time required for the plunger to reach the BHA on every cycle.

Evolutionary Deep Belief Network for Cyber-Attack Detection in Industrial Automation and Control System

Industrial automation and control systems (IACS) are tremendously employing supervisory control and data acquisition (SCADA) network. However, their integration into IACS is vulnerable to various cyber-attacks. In this article, we first present population extremal optimization (PEO)-based deep belief network detection method (PEO-DBN) to detect the cyber-attacks of SCADA-based IACS. In PEO-DBN method, PEO algorithm is employed to determine the DBN's parameters, including number of hidden units and the size of mini-batch and learning rate, as there is no clear knowledge to set these parameters. Then, to enhance the performance of single method for cyber-attacks detection, the ensemble learning scheme is introduced for aggregation of the proposed PEO-DBN method, called EnPEO-DBN. The proposed detection methods are evaluated on gas pipeline system dataset and water storage tank system dataset from SCADA network traffic by comparing with some existing methods. Through performance analysis, simulation results show the superiority of PEO-DBN and EnPEO-DBN.

Resiliency-Aware Deployment of SDN in Smart Grid SCADA: A Formal Synthesis Model

The supervisory control and data acquisition (SCADA) network in a smart grid requires to be reliable and efficient to transmit real-time data to the controller, especially when the system is under contingencies or cyberattacks. Introducing the features of software-defined networks (SDN) into a SCADA network helps in better management of communication and deployment of novel grid control operations. Unfortunately, it is impossible to transform the overall smart grid network to have only SDN-enabled devices overnight because of budget and logistics constraints, which raises the requirement of a systematic deployment methodology. In this article, we present a framework, named SDNSynth, that can design a hybrid network consisting of both legacy forwarding devices and programmable SDN-enabled switches. The design satisfies the resiliency requirements of the SCADA network, which are determined with respect to a set of pre-identified threat vectors. The resiliency-aware SDN deployment plan primarily includes the best placements of the SDN-enabled switches (replacing the legacy switches). The plan may include one or more links to be installed newly to provide flexible or alternate routing paths. We design and implement the SDNSynth framework that includes the modeling of the SCADA topology, SDN-based resiliency measures, resiliency threats, mitigation requirements, the deployment budget, and other constraints. It uses satisfiability modulo theories (SMT) for encoding the synthesis model and solving it. We demonstrate SDNSynth on a case study of an example small-scale network. We also evaluate SDNSynth on different synthetic SCADA systems and analyze how different parameters impact each other. We simulate the SDNSynth suggested networks in a Mininet environment, which demonstrate the effectiveness of the deployment strategy over traditional networks and randomly deployed SDN switches in terms of packet loss and recovery time during network congestions.