A Multi-Step Attack Detection Model Based on Alerts of Smart Grid Monitoring System

Smart Grid Monitoring System(SGMS) is an important means to protect the security of smart grid. The high volumes of alerts generated by SGMS often confuse managers. Automatically handling alerts and extracting attack events is a critical issue for smart grid. Most of the existing security event analysis methods are designed for Internet, which will not be directly applicable to the power grid for high reliability and low attack tolerance requirements. In this paper, a multi-step attack detection model based on alerts of SGMS is proposed. In this model, an alert graph is constructed by IP correlation, and then transformed into candidate attack chains after being aggregated. Consequently, the candidate preliminary attack chains are pruned and denoised by negative causal correlation and non-cascading events. Finally, attack chains and visual attack graphs are formed. Our proposal model needs a little of priori knowledge while automatically extracting multi-step attack events and demonstrating the trajectories among IPs. The experimental results show the model performs well on China Grid data and DARPA 2000 data set.