|Project Publications and Talks||Summary||Collaborators||Funding|
Smart meters are becoming pervasive in smart electric grids, and their security is a major concern. However, most solutions for security of smart meters work at the network level or perform remote attestation of the device. While these are useful, they do not protect the device from targeted attacks that occur after the device has been booted up. To effectively ensure the security of the smart metering devices, we need efficient host-based Intrusion Detection Systems (IDSs) that run on the meters. Unfortunately, smart meters have limited computational capacity and hence it is challenging to run existing host-based IDSes on them. A further complication of smart meters is that due to their scale of deployment, any solution should be free of false-positives, which rules out many commonly used anomaly detection techniques based on statistical techniques.
In this project, we devise a host-based IDS for smart meters that uses a model of the smart meter’s behavior to choose which system calls to monitor. We develop a high-level model of the smart meters’ behaviors based on their specifications as outlined in standards documents, which we call the abstract model. We then map specific code blocks in the smart meter’s implementation to the abstract model using static analysis and annotations. We call this the concrete model (see figure above from SEGMeter, a smart meter used in our lab). Finally, we choose system calls to monitor in the concrete model based on a generic attack taxonomy. We find that our host-based IDS can achieve high coverage for common attacks on smart metering platform with an order of magnitude less overhead than existing techniques which monitor all system calls. We further find that the IDS can detect an attack within about 10 seconds, which is sufficient time to prevent the attack from propagating to other meters. We are working on formalizing the guarantees provided by this approach, and on applying it to other low-level embedded devices.
Students: Farid Tabrizi, Maryam Raiyat
NSERC DIVA, Nokia Canada