ExtHT: A hybrid tracing method for cyber-attacks in power industrial control systems

Area of Science:

• Cybersecurity
• Industrial Control Systems
• Network Security

Background:

• Power Industrial Control Systems (PICS) are vulnerable to cyber-attacks, necessitating effective source tracing for defense.
• Existing internet-based attack traceback methods are inadequate for PICS due to limitations in granularity, real-time performance, and protocol support.

Purpose of the Study:

• To propose a novel cyber-attack source tracing method specifically designed for PICS.
• To enhance the security and resilience of critical power infrastructure against sophisticated cyber threats.

Main Methods:

• An extended hybrid tracing (ExtHT) method combining packet marking and packet logging is developed.
• ExtHT incorporates all relevant network layers for fine-grained tracing and offers a coarse-grained mode for improved speed.
• A log database optimization scheme is presented to manage storage costs effectively.

Main Results:

• The proposed ExtHT method achieves fine-grained and real-time cyber-attack source tracing in PICS.
• Coarse-grained tracing mode enhances tracing speed, while log optimization reduces storage requirements.
• The feasibility of ExtHT was verified through simulations in realistic cyber-attack scenarios.

Conclusions:

• The developed ExtHT method provides a robust solution for cyber-attack source traceback in PICS.
• This research contributes to improving the security posture and operational stability of power grid control systems.
• ExtHT offers a practical and efficient approach for defending critical infrastructure against evolving cyber threats.