Search: onr:"swepub:oai:research.chalmers.se:81eb7b79-dfda-4655-8401-e3f865170aa3"
> (2015) >
METIS: a Two-Tier I...
METIS: a Two-Tier Intrusion Detection System for Advanced Metering Infrastructures
-
- Gulisano, Vincenzo Massimiliano, 1984 (author)
- Chalmers tekniska högskola,Chalmers University of Technology
-
- Almgren, Magnus, 1972 (author)
- Chalmers tekniska högskola,Chalmers University of Technology
-
- Papatriantafilou, Marina, 1966 (author)
- Chalmers tekniska högskola,Chalmers University of Technology
-
(creator_code:org_t)
- 2015-11-19
- 2015
- English.
-
In: Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering. - Cham : Springer International Publishing. - 1867-8211 .- 1867-822X. ; 153, s. 51-68
- Related links:
-
http://dx.doi.org/10...
-
show more...
-
http://www.syssec-pr...
-
https://research.cha...
-
https://doi.org/10.1...
-
show less...
Abstract
Subject headings
Close
- In the shift from traditional to cyber-physical electric grids, motivated by the needs for improved energy efficiency, Advanced Metering Infrastructures have a key role. However, together with the enabled possibilities, they imply an increased threat surface on the systems. Challenging aspects such as scalable traffic analysis, timely detection of malicious activity and intuitive ways of specifying detection mechanisms for possible adversary goals are among the core problems in this domain. Aiming at addressing the above, we present METIS, a two-tier streaming-based intrusion detection framework. METIS relies on probabilistic models for detection and is designed to detect challenging attacks in which adversaries aim at being unnoticed. Thanks to its two-tier architecture, it eases the modeling of possible adversary goals and allows for a fully distributed and parallel traffic analysis through the data streaming processing paradigm. At the same time, it allows for complementary intrusion detection systems to be integrated in the framework. We demonstrate METIS’ use and functionality through an energy exfiltration use-case, in which an adversary aims at stealing energy information from AMI users. Based on a prototype implementation using the Storm Stream Processing Engine and a very large dataset from a real-world AMI, we show that METIS is not only able to detect such attacks, but that it can also handle large volumes of data even when run on commodity hardware.
Subject headings
- TEKNIK OCH TEKNOLOGIER -- Elektroteknik och elektronik -- Kommunikationssystem (hsv//swe)
- ENGINEERING AND TECHNOLOGY -- Electrical Engineering, Electronic Engineering, Information Engineering -- Communication Systems (hsv//eng)
- TEKNIK OCH TEKNOLOGIER -- Elektroteknik och elektronik -- Datorsystem (hsv//swe)
- ENGINEERING AND TECHNOLOGY -- Electrical Engineering, Electronic Engineering, Information Engineering -- Computer Systems (hsv//eng)
Keyword
- Intrusion Detection systems
- Data streaming
- Advanced metering infrastructures
Publication and Content Type
- kon (subject category)
- ref (subject category)
Find in a library
To the university's database