Cross-layer Device Identification for Smart Grid Substation Networks : IEEE CNS 23 Poster

Smart grid (SG) substations are responsible for the grid’s smooth operation. SG substations consist of several interacting components that communicate over the network. Attacks on the SG substation communication can lead to dire consequences like loss of power or even worse. Device fingerprinting can help identify malicious devices and communications. Although device fingerprinting has been studied for cyber-physical systems, mostly in wireless scenarios, there is little to no work for SG substation networks. We develop a device fingerprinting framework for SG substations using a cross-layer approach. We specifically developed our approach for the IEC68150 standard, a commonly used communication standard in SG substations. We took a cross-layer device fingerprinting approach with three models-the Link layer model, Transport layer model and the stacking-based ensemble cross-layer model using logistic regression. We analyzed the accuracy in device identification of our cross-layer approach on a real world SG substation-like dataset 4SICS. The results show that our cross-layer approach is a feasible option to fingerprint SG devices. To the best of our knowledge, our work is the first device fingerprinting work done on SG substation networks.