Detecting Attacks in Power Plant Interfacing Substations through Probabilistic Validation of Attack-Effect Bindings

In this paper we provide a mathematical approach to detection of attacks on relays in electrical substations speaking IEC 61850, an abstract industrial protocol devised by the Technical Committee 57 of the International Electrotechnical Commission as a standard for substation communications. Our contribution regards those electrical transmission substations which interface with the generators of a power plant through step-up transformers. In this paper we take as an instance power plants which use nuclear reactors as a source of energy. The basis of the proposed approach is formed by structural equations which semantically model the relations between operational variables of substation and nuclear power plant components as monitored by the respective control systems. Causality relations investigated via structural equations are reflected on Bayesian belief networks to probabilistically characterize the legitimacy and abnormality of IEC 61850 traffic. We then employ the stochastic activity network formalism to construct composed models of substation operation from which we derive intrusion detection rules.