Optimal Inspection Points for

Malicious Attack Detection

in Smart Grids

Suhankar Mishra1, Thang N. Dinh2,

My T. Thai1, and Incheol Shin3
Dept. of Comp. & Inf. & Sci. & Eng., University of Florida, Gainesville, Florida, USA1
Dept. of Comp. Sci., Virginia Commonwealth University, Richmond, VA, USA2
Info. Security Dept., Mokpo National University Muan, Rep. of Korea3

COCOON 2014 Thang N. Dinh

tndinh@vcu.edu 1
Outline
 Motivation

 Optimal Inspection Points Problem

 Single-path routings: FPTAS for trees

 Multiple-path routing: FPTAS for SP-graphs

 Discussion

COCOON 2014 Thang N. Dinh

tndinh@vcu.edu 2
Motivation
 Smart grids =
o Old electricity network
o New communication
o Intelligence
o Automation

 SCADA (Distribution
Supervisory Control and Data Acquisition)
o Transmits individual device status, distribution control
commands, access logs, etc.
o Vulnerable to intercepting, tampering, and forging data

COCOON 2014 Thang N. Dinh

tndinh@vcu.edu 3
Motivation (cont.)
 Solution: Deep Packet Inspection (DPI)
o Advanced Firewalls for SCADA/ICS
o Dig deeper into the protocols to understand the message
content and apply more detailed rules

 Challenges
o Cannot be deployed at all points (e.g. economic reason)
o Cannot scanned all messages (limited capacity)
o Strict latency constraints
• Exp: 3ms for fault isolation and protection control
messages (IEC 61850)

COCOON 2014 Thang N. Dinh

tndinh@vcu.edu 4
Optimal Inspection Points (OIP)
Problem : DPI delay
: center : Capacity
: Packet flow
: Intmd nodes

S: terminal nodes

COCOON 2014 Thang N. Dinh

tndinh@vcu.edu 5
OIP Problem (cont.)
 Input: A directed acyclic graph
o , where
• : SCADA center. All packets are forwarded towards
• S: Terminal nodes that might send malicious packets.
• O: Set of intermediate nodes where DPI can be deployed
o : Delay caused by employing DPI at ,
o : Capacity (#packets) of DPI scanner at ,
o : Maximum allowable delay for DPI at
o Flow : traffic(#packets) ,
 Problem: Find a subset of points to deploy DPI
o Accumulating delay at for DPI
o Maximize the #scanned packets

COCOON 2014 Thang N. Dinh

tndinh@vcu.edu 6
Complexity

 Theorem 1: OIP problem is NP-complete, even when

the graph is a simple path.

COCOON 2014 Thang N. Dinh

tndinh@vcu.edu 7
Single-path vs. Multi-path routing
Single-path routing Multi-path routing
(Single route, E.g. OSPF) (Different routes possible)

u u

#packets routed along

is proportional to

COCOON 2014 Thang N. Dinh

tndinh@vcu.edu 8
Single-path routing
 The graph is a tree rooted at

 There exists Fully Polynomial-Time Approximation

Scheme

COCOON 2014 Thang N. Dinh

tndinh@vcu.edu 9
Single-path routing

COCOON 2014 Thang N. Dinh

tndinh@vcu.edu 10
Single-path: Dynamic Programming

COCOON 2014 Thang N. Dinh

tndinh@vcu.edu 11
Multi-path routing

 FPTAS for Series-Parallel graphs

COCOON 2014 Thang N. Dinh

tndinh@vcu.edu 12
Multi-path: FPTAS

COCOON 2014 Thang N. Dinh

tndinh@vcu.edu 13
Multi-path: FPTAS
 Series Operations

 Parallel Operations

COCOON 2014 Thang N. Dinh

tndinh@vcu.edu 14
Conclusions & Discussion
 Introduce Optimal Inspection Points problem in
Smart Grids and prove its NP-completeness.

 FPTAS for single-path routing

 FPTAS for multi-path routing in SP-graphs

 Approximation Algorithms for Multi-path routing in

general graph

COCOON 2014 Thang N. Dinh

tndinh@vcu.edu 15
Questions & Answers

Thank you for your listening!

COCOON 2014 Thang N. Dinh

tndinh@vcu.edu 16