WO2015160010A1

WO2015160010A1 - System for detecting abnormal behavior in smart grid ami network, and method using same

Info

Publication number: WO2015160010A1
Application number: PCT/KR2014/003366
Authority: WO
Inventors: 신인철; 김신규; 서정택
Original assignee: 한국전자통신연구원
Priority date: 2014-04-17
Filing date: 2014-04-17
Publication date: 2015-10-22

Abstract

A system for detecting abnormal behavior in a smart grid AMI network, and a method using the same are disclosed. The system for detecting abnormal behavior in a smart grid AMI network comprises: a network packet receiving device which receives network packets in a smart grid AMI network and identifies a protocol packet of interest to be monitored; a packet analyzer for separating a header and a payload of the protocol packet of interest; an apparatus information storage device for providing apparatus information of an apparatus corresponding to the header; an apparatus state transition information storage device which updates apparatus state transition information of the apparatus corresponding to the apparatus information and detects occurrence of abnormal behavior on the basis of the apparatus state transition information; and a network packet transmitting device for transmitting the protocol packet of interest only when the occurrence of abnormal behavior is not detected.

Description

Anomaly Detection System and Method Using the Same in Smart Grid AML Network

The present invention relates to a technology for responding to various cyber attacks targeting a controller in a smart grid AMI (Advanced Metering Infrastructure) system, an anomaly detection system and method using the same in a smart grid AMI network through network packet analysis (ABNOMAL BEHAVIOR DETECTION SYSTEM IN SMART GRID ADVANCED METERING INFRASTRUCTURE NETWORK AND METHOD USING THE SAME).

Smart meters play an important role in the Advanced Metering Infrastructure (AMI), which has evolved from the previous one-way automatic meter reading system (AMR) to enable two-way data communication between consumers and utilities. Can be said to be the target device that has the greatest damage ripple effect when a cyber attack occurs on the smart grid system. In addition, NAN (Neighborhood Area Network) composed of smart meters is located at the connection point with external public network, which is a target of various malware attacks. Therefore, not only the smart meter but also the network composed of embedded system such as DCU (Data Concentration Unit) in smart grid AMI should be protected from external attack and for this purpose, it is essential to install anomalies detection system for smart grid AMI network.

However, since the smart grid AMI network is composed of embedded devices designed and manufactured using limited system resources, it is impossible to apply intrusion detection and network anomaly detection systems that operate based on abundant system resources in the existing Internet environment. Do.

Unlike the terminals in the existing Internet environment, the smart grid AMI system has only limited system resources because it performs functions according to a predetermined routine unlike terminals in the existing Internet environment. Due to such an operating environment, the various embedded devices of the smart grid AMI system have security weaknesses, but it is difficult to expect an improvement in system performance due to a problem such as an increase in device manufacturing cost.

The technical problem to be achieved by the present invention is to detect anomalies in communication traffic between devices using the Smart Grid AMI protocol, which consists only of limited system resources by performing functions according to a predetermined routine in a short time. It is.

In addition, an object of the present invention is to provide a higher security at a lower cost by performing intrusion detection and anomaly detection without the addition of additional hardware smart grid AMI embedded devices using the same protocol.

In addition, an object of the present invention is to implement a simple and economical detection function than the network traffic anomaly detection system operating in the existing Internet environment by using the characteristics of the smart grid AMI network environment.

In order to achieve the above technical problem, the abnormal behavior detection system of the monitoring device in the smart grid AMI network according to the present invention includes a network packet receiving device for identifying a target protocol packet to receive and monitor the network packets in the smart grid AMI network; A packet analyzer for separating a header and a payload of the target protocol packet; A device information storage device for providing device information of a device corresponding to the header; A device state transition information storage device for updating device state transition information of a device corresponding to the device information and detecting occurrence of an abnormal behavior based on the device state transition information; And a network packet transmission device configured to deliver the target protocol packet only when the occurrence of the abnormal behavior is not detected.

In addition, the abnormal behavior detection method in the smart grid AMI network according to the present invention, the network packet receiving apparatus for receiving the network packets in the smart grid AMI network to identify the target protocol packet to be monitored; Separating, by a packet analyzer, the header and payload of the target protocol packet; Providing, by the device information storage device, device information of the device corresponding to the header; Updating, by the device state transition information storage device, device state transition information of a device corresponding to the device information, and detecting occurrence of an abnormal behavior based on the device state transition information; And forwarding the target protocol packet only when the occurrence of the abnormal behavior is not detected.

According to an embodiment of the present invention, devices performing traffic monitoring in the smart grid AMI network maintain and update network state transition information of all devices through communication packet analysis. Through this, packets that are in violation of the network protocol and interfere with the normal operation of the target device are detected and identified as anomalous. More specifically, unlike the prior art, the present invention provides methods for identifying a message that induces an abnormal state transition by analyzing network state transition information of all devices through analysis of communication packets using the smart grid AMI protocol. do. This method allows devices using the same protocol to detect intrusions and abnormal behaviors without additional hardware, thereby providing higher security at a lower cost.

1 is a view schematically illustrating a smart grid AMI network anomaly detection system according to an embodiment of the present invention.

2 is a flowchart illustrating a method for detecting anomalous behavior of a smart grid AMI network according to an embodiment of the present invention.

3 is an example of a data structure for maintaining and updating device state information in a device information storage device.

4 is a device state information structure in a device state transition information storage device.

Hereinafter, the present invention will be described with reference to the accompanying drawings. Here, the repeated description, well-known functions and configurations that may unnecessarily obscure the subject matter of the present invention, and detailed description of the configuration will be omitted. Embodiments of the present invention are provided to more completely describe the present invention to those skilled in the art. Accordingly, the shape and size of elements in the drawings may be exaggerated for clarity.

In order to detect anomalous behavior of communication traffic of smart grid AMI system devices that are located in a large area and provide various services for the purpose of improving power efficiency, it is necessary to track state transition information of all devices in the network. Do. However, terminals operating in the existing Internet environment are equipments manufactured based on abundant system resources, and are designed to be suitable for providing various services. Therefore, protection programs designed to protect them and respond to cyber attacks are not designed for smart grid AMI embedded environment because they are designed and manufactured considering more services and perform relatively fewer functions with limited resources. Therefore, there is a need for a lightweight approach that is different from the existing methods. In other words, it should be designed to minimize the load on the system and to detect smart grid communication protocol anomalies in network traffic in a short time with consideration of the characteristics of smart grid AMI embedded devices using limited system resources. Therefore, the present invention relates to the invention of a lightweight state transition information tracking system for embedded devices and network devices in the system through smart grid AMI protocol packet analysis.

Smart Grid AMI network can track the state transition information of all devices through the analysis of network traffic packets exchanged between the embedded systems performing only the tasks defined according to the corresponding protocol. This is possible because all message delivery paths of the smart grid AMI network are not fluid and are maintained and managed through configuration. In other words, it can be explained in other words that a message to a specific device has a network environment characteristic that can be achieved only through predetermined devices. By maximizing the advantages of the environmental characteristics, it is possible to maintain the state transition information of the destination devices through the analysis of network communication messages transmitted through any device, and also to detect packets causing abnormal behaviors through the corresponding information. . In addition, even in a fluidly changing network, all devices are connected to at least one relay or network device so that state transition information can be maintained through such devices.

In order to track such state transition information, the present invention will be described for methods for smart grid AMI protocol packet analysis and state transition information maintenance and updating.

The present invention tracks the state transition information of the network device through the analysis of smart grid AMI (Advanced Metering Infrastructure) protocol communication packet in order to respond to cyber attacks targeting the smart grid AMI network, The transition will confirm that the transition is legitimate for the Smart Grid AMI communication protocol. According to the present invention, when a state transition of a receiving device deviates from a predetermined state due to a collected specific packet, the packet is identified as an abnormal behavior and discarded. This detection method is possible due to the difference in communication environment between the smart grid AMI environment and the Internet environment. In other words, while the transmission path of communication packets is flexible in the Internet environment, the communication path between arbitrary devices does not change in the smart grid network. The path through which a series of messages sent for communication between two specific devices in a smart grid AMI environment travels through a path determined at the time of network configuration. The difference is that the path is diversified due to network congestion. Due to such characteristics, it is possible to track the network state transition information of the smart grid AMI device, and it is possible to configure the smart grid AMI network protocol target abnormal behavior detection system according to the present invention. An object of the present invention is to implement a lightweight detection function than the network traffic anomaly detection system operating in the existing Internet environment by using the characteristics of the smart grid AMI network environment. This makes it possible to efficiently configure anomaly detection systems that can be used in smart grid AMI embedded devices and network devices.

Devices performing traffic monitoring in the smart grid AMI network maintain and update network state transition information of target devices through communication packet analysis. Through this, packets that are in violation of the network protocol and interfere with the normal operation of the target device are detected and identified as anomalous. In other words, unlike the prior art, the present invention identifies messages inducing abnormal state transitions through network state transition information analysis of all devices through analysis of communication packets using the smart grid AMI protocol. This method allows devices using the same protocol to detect intrusions and anomalies without additional hardware, thereby providing higher security at a lower cost.

Hereinafter, a system for detecting abnormal behavior in a monitoring device of a smart grid AMI network and a method of operating the system will be described in detail with reference to the accompanying drawings.

1 is a block diagram illustrating an anomaly detection system of a smart grid AMI network according to an embodiment of the present invention.

Referring to FIG. 1, an abnormal behavior detection system in a smart grid AMI network according to the present invention includes a network packet receiver 101, a packet analyzer 102, a device information storage device 103, and a device state transition information storage device ( 104 and a network packet transmission device 105.

The network packet receiver 101 may be implemented in a network device such as a terminal, a message delivery device, a router, and a switch in a smart grid AMI network, and analyzes and interprets a message using a target protocol that is an object of anomaly detection. To perform. That is, in the network packet receiving apparatus 101, any device capable of packet monitoring may be a candidate.

The network packet receiving apparatus 101 receives all packets arriving through the network communication unit, checks a target protocol packet to be monitored, and then transfers the identified target protocol packet to the packet analyzer 102.

The packet analyzer 102 separates the protocol header and the payload, and passes the packet header to the device information storage 103.

The device information storage device 103 finds the device by using the receiving device address in the received packet header and transfers the device information to the device state transition information storage device 104.

The device state transition information storage device 104 updates the device state transition information and does not send the packet to the network packet transmission device 105 when an abnormal behavior occurs, and transmits the packet only when there is no error. Filter the packet by forwarding

2 is a diagram illustrating an anomaly detection method in a smart grid AMI network according to an embodiment of the present invention.

Referring to FIG. 2, the method for detecting anomalous behavior in the smart grid AMI network is a packet analyzer 102 when the network packet received through the network packet receiver 101 is an anomalous symptom detection protocol and is interpretable. Deliver the contents of the reception. The packet analyzer 102 separates the header and payload of the received packet to determine whether there is a simple abnormality of the protocol information, and transfers the header of the received packet to the device information storage device 103 to obtain device information corresponding to the destination address. do. The device state information storage device 104 updates the state transition information of the device through the identification information of the device, and confirms whether the state transition of the device is safe through the information. Only when the state transition is secure is sent to the network packet transmitter 105.

3 is a diagram for describing a method of maintaining device information in the device information storage device 103.

The device information storage device 103 basically maps network devices to one node and maintains a binary tree using a node ID (or a unique number such as an address value). However, the node (device) accessed through the address value of the packet collected through the network packet receiver 101 of the monitoring device is raised by one level in the tree structure. This increases the locality of the tree. This allows faster access to the node when messages corresponding to the same destination arrive when the message arrives. Furthermore, the DoS attack traffic generating device can be identified. However, because the binary tree must be maintained, the parent node may be insufficient when the level is increased. In this case, the parent node is branched through the dummy node to maintain the binary tree format. 3 illustrates an example of a structure update process according to the second node access, wherein a black node is a device node and a white node is a dummy node.

4 illustrates a structure of device state information in the smart grid device state transition information storage device 104 according to an embodiment of the present invention. This basically converts the information of the header field, which causes the state transition of the device in the Smart Grid AMI protocol, to a binary value to create a binary graph and maintains a binary graph. Navigate through the graph. If you deviate from the graph like this, the message including the allowed header values did not arrive and it is detected and identified as an anomaly. When anomalous behavior occurs, the message is filtered and not transmitted to the network packet transmitter 105. Otherwise, the state information is transferred so that the device points to the state node of the binary graph. 4 is an example of a state transition information structure in which a state transition instruction "0110" should be received after a state transition instruction "0101". In this example, when a command other than "0110" is received after "0101", it can be detected as an abnormal behavior.

Claims

A network packet receiving apparatus for identifying a target protocol packet to be monitored by receiving network packets in a smart grid AMI network;

A packet analyzer for separating a header and a payload of the target protocol packet;

A device information storage device for providing device information of a device corresponding to the header;

A device state transition information storage device for updating device state transition information of a device corresponding to the device information and detecting occurrence of an abnormal behavior based on the device state transition information; And

Network packet transmission device for delivering the target protocol packet only when the occurrence of the abnormal behavior is not detected

Anomaly detection system in a smart grid AMI network comprising a.
The method according to claim 1,

The device information storage device

The abnormal behavior detection system in the AMI network, characterized in that for storing the information of the network devices using a binary tree that maps the network devices in the smart grid AMI network to nodes.
The method according to claim 2,

The device information storage device

The access node increases the locality of the binary tree by increasing a level value in the binary tree.
The method according to claim 3,

The device information storage device

The abnormal behavior detection system in the AMI network, characterized in that to maintain the structure of the binary tree by branching the parent node using a dummy node when the parent node is insufficient in increasing the level value.
The method according to claim 1,

The device state transition information storage device

The abnormal behavior detection system in the AMI network, characterized in that for maintaining the device state transition information using a binary graph generated by converting the information value of the header field to a binary value.
Identifying, by the network packet receiving apparatus, a target protocol packet to be monitored by receiving network packets in a smart grid AMI network;

Separating, by a packet analyzer, the header and payload of the target protocol packet;

Providing, by the device information storage device, device information of the device corresponding to the header;

Updating, by the device state transition information storage device, device state transition information of a device corresponding to the device information, and detecting occurrence of an abnormal behavior based on the device state transition information; And

Delivering the target protocol packet only when the occurrence of the abnormal behavior is not detected;

Anomaly detection method in a smart grid AMI network comprising a.
The method according to claim 6,

Providing the device information

Anomaly detection method in an AMI network, characterized in that to provide information of the network devices using a binary tree that maps the network devices in the smart grid AMI network to nodes.
The method according to claim 7,

Providing the device information

The method for detecting anomalous behavior in an AMI network characterized by increasing the locality of the binary tree by increasing a level value in the binary tree for an accessed node.
The method according to claim 8,

Providing the device information

The method for detecting abnormal behavior in an AMI network, in which the structure of the binary tree is maintained by branching the parent node using a dummy node when the parent node is insufficient in increasing the level value.
The method according to claim 6,

Detecting the occurrence of the abnormal behavior

And detecting the device state transition information by using a binary graph generated by converting an information value of a header field into a binary value.