Defending Electrical Substations Against 0-Day Malware Through Decoy I/O in Protective Relays

Recent cyber attack campaigns, such as those supported by the BlackEnergy and Dragonfly malware, have targeted protective relays over the network. Protective relays are the ultimate attack target as they interface directly with physical lines and equipment in electrical substations. A compromised relay allows the attacker to operate circuit breakers, and thus disrupt the transmission and distribution of power. Malware that implement control theoretical models can cause and also maximize physical permanent damage to the power equipment. We present a defensive deception approach that operates on the protective relays of an electrical substation. We use kernel drivers on a protective relay to create dynamic decoys, which consist of emulated I/O boards and their hardware controllers. A phantom I/O board is operated in conjunction with closely monitored memory buffers that are accessible in user space. We store in those buffers dynamic decoy data associated with the phantom substation equipment and processes that the phantom I/O board appears to interface with. Those data are generated and stored as per the IEC 61850 protocol, and can be retrieved over the MMS and OPC protocols. Our approach mimics a protective relay's interaction with segments of the electrical substation, which in fact are all decoys. Our approach can detect 0-day malware on protective relays in production, without any prior knowledge of their internal code and data. We performed practical validations against malware samples involved in recent cyber attack campaigns, and discuss the findings in the paper.