Alessia Garofalo. Critical Infrastructure Protection Cyber Security for Wireless Sensor Networks. Fai della Paganella, 10-12/02/2014

Transcription

1 Alessia Garofalo Ph.D. Student in Information Engineering University of Naples «Parthenope» Critical Infrastructure Protection Cyber Security for Wireless Sensor Networks Fai della Paganella, 10-12/02/2014

2 Power Grid and Smart Grid Power grids represent a core utility of any nation, however they were initially designed to meet basic requirements as keeping lights turned on. So, they were not capable of managing the increase of load that was experienced during the years. Smart Grid systems represent the natural evolution of the Power Grid. The Smart Grid is a planned nationwide network that uses information technology to deliver electricity efficiently, reliably, and securely. [1] A Smart Grid is typically monitored through Wide Area Monitoring Systems (WAMSs), that make use of devices distributed throughout the power grid that measure the key parameters to detect anomalous conditions. [1] NIST, Smart Grid: A Beginner s Guide [

3 A Case Study: GPS Spoofing The most used devices in WAMS are called Phasor Measurement Units (PMUs). PMUs are devices that perform measurements of real-time phasors of voltages and currents to provide information about power grid status. The goal of GPS spoofing attacks is to provide a forged version of the GPS signal to take control of a GPS receiver. So if an attacker successfully performs a GPS spoofing attack he/she can compromise the monitoring system of the power grid.

4 A Case Study: GPS Spoofing An architecture was proposed to detect GPS Spoofing attacks. The approach proposed is based on: Redundant time source Spoofing detector i.e. a component that monitors the absolute GPS signal strength.

5 Wireless Sensor Networks A wireless sensor network is a collection of nodes organized into a cooperative network. Each node consists of processing capability [ ], may contain multiple types of memory [ ], has a RF transceiver [ ], has a power source [ ], and accommodate various sensors and actuators. The nodes communicate wirelessly and often self-organize after being deployed in an ad hoc fashion. Systems of 1000s or even 10,000 nodes are anticipated. Such systems can revolutionize the way we live and work. [1] [1] J. Hill, R. Szewczyk, A, Woo, S. Hollar, D. Culler, and K. Pister, System Architecture Directions for Networked Sensors, ASPLOS, November 2000

6 Intrusion Detection Systems on Wireless Sensor Networks Cyber Security is a relevant issue on Wireless Sensor Networks (WSNs) because: They are more vulnerable to security threats than their wired counterparts They are constituted of tiny sensors which lack processing, memory, battery power, and so weaker security mechanisms can be applied to them Intrusion detection is the process of monitoring the events occurring in a computer system or network and analyzing them for signs of possible incidents [ ]. An intrusion detection system (IDS) is software that automates the intrusion detection process. [1] Employing Intrusion Detection Systems (IDSs) on Wireless Sensor Networks (WSNs) is challenging because of the low sensors capabilities [1] NIST Guide to Intrusion Detection and Prevention Systems (IDPS)

7 Cyber Attacks to WSNs The purpose of Sinkhole Attack is to gain access to traffic in the area of the WSN in order to launch more severe attacks: Attacks to integrity of data routed Selective/full dropping of packets routed attacks to privacy of data routed To perform sinkhole attack successfully, the attacker tries to attract packets to a compromised node that belongs to the WSN. The compromised node is advertised to other nodes as a high-quality route. Nodes in the network are then encouraged to include the compromised node in their routes. When this operation is effectively performed on legitimate nodes, the attack is successful.

8 Cyber Attacks to WSNs The purpose of Sleep Deprivation attack is to deny the service offered by nodes by depleting their resources. This can be performed by flooding nodes with packets and not allowing them to go to sleep mode and save energy.

9 Ad hoc On-demand Distance Vector AODV is defined by RFC 3561: The Ad hoc On-Demand Distance Vector (AODV) routing protocol is intended for use by mobile nodes in an ad hoc network. It offers quick adaptation to dynamic link conditions, low processing and memory overhead, low network utilization, and determines unicast routes to destinations within the ad hoc network. It uses destination sequence numbers to ensure loop freedom at all times (even in the face of anomalous delivery of routing control messages), avoiding problems (such as "counting to infinity") associated with classical distance vector protocols.

10 Hybrid IDS Combines centralized and decentralized approaches Combines anomaly and misuse detection approaches IDS Local Agent Performs local data collection and monitors potential attacks IDS Central Agent Has full knowledge of the network security state Detects potential attacks through its global knowledge of the network security state

11 Local Agent: EMA vs MA EMA = Exponential Moving Average MA = Moving Average α = smoothing factor N = window size

12 Central Agent: Decision Trees AttackerType Target Improvement Conditions

13 Trust and Reputation Systems Trust can be defined as the quantified belief by a trustor with respect to the competence, honesty, security and dependability of a trustee within a specified context. [1] Reputation is a measure of the trust that the whole community perceives with respect to a given trustee. [2] Node A needs to send data to Node D. Which route is more reliable? Trust measurements are used to choose nodes (and related routes). [1] Grandison T, Sloman M. Trust management tools for internet applications. In: Proc 1st Int. Conf Trust Management, Heraklion, Crete, Greece, Springer; pp [2] Domenico Rosaci, Trust measures for competitive agents, Knowledge-Based Systems, Volume 28, April 2012, Pages 38-46, ISSN ,

14 Future works To complete a Trust-based system to ensure cyber security in Wireless Sensor Networks To ensure context-aware cyber security on CIs through heterogeneous data sources (including Wireless Sensor Networks)

15 Thank You