A Firewall Optimization for Threat-Resilient Micro-Segmentation in Power System Networks
Electric power delivery relies on a communications backbone that must be secure. SCADA systems are essential to critical grid functions and include industrial control systems (ICS) protocols such as the Distributed Network Protocol-3 (DNP3). These protocols are vulnerable to cyber threats that power systems, as cyber-physical critical infrastructure, must be protected against. For this reason, the NERC Critical Infrastructure Protection standard CIP-005-5 specifies that an electronic system perimeter is needed, accomplished with firewalls. This paper presents how these electronic system perimeters can be optimally found and generated using a proposed meta-heuristic approach for optimal security zone formation for large-scale power systems. Then, to implement the optimal firewall rules in a large scale power system model, this work presents a prototype software tool that takes the optimization results and auto-configures the firewall nodes for different utilities in a cyber-physical testbed. Using this tool, firewall policies are configured for all the utilities and their substations within a synthetic 2000-bus model, assuming two different network topologies. Results generate the optimal electronic security perimeters to protect a power system's data flows and compare the number of firewalls, monetary cost, and risk alerts from path analysis.
Code (0)
등록된 구현이 없습니다.
Similar Papers 제목 키워드 기반
Adaptive Dual-Layer Web Application Firewall (ADL-WAF) Leveraging Machine Learning for Enhanced Anomaly and Threat Detection
Web Application Firewalls are crucial for protecting web applications against a wide range of cyber threats. Traditional Web Application Firewalls often struggle to effectively distinguish between malicious and legitimat…
Feature EngineeringAnomaly DetectionFrom Threat Intelligence to Firewall Rules: Semantic Relations in Hybrid AI Agent and Expert System Architectures
Web security demands rapid response capabilities to evolving cyber threats. Agentic Artificial Intelligence (AI) promises automation, but the need for trustworthy security responses is of the utmost importance. This work…
Pro-ZD: A Transferable Graph Neural Network Approach for Proactive Zero-Day Threats Mitigation
In today's enterprise network landscape, the combination of perimeter and distributed firewall rules governs connectivity. To address challenges arising from increased traffic and diverse network architectures, organizat…
Graph Neural NetworkCyber-resilient Automatic Generation Control for Systems of AC Microgrids
In this paper we propose a co-design of the secondary frequency regulation in systems of AC microgrids and its cyber securty solutions. We term the secondary frequency regulator a Micro-Automatic Generation Control (Micr…
Cyber Attack DetectionLyapunov-based Resilient Secondary Synchronization Strategy of AC Microgrids Under Exponentially Energy-Unbounded FDI Attacks
This article presents fully distributed Lyapunov-based attack-resilient secondary control strategies for islanded inverter-based AC microgrids, designed to counter a broad spectrum of energy-unbounded False Data Injectio…