Distributed IP Watchlist Generation for Intrusion Detection in the Electrical Smart Grid

The electric power infrastructure in the United States is undergoing a significant transformation. To enhance the ability of the grid to support the use of diverse and renewable energy resources and to respond to problems more quickly, the infrastructure is being redesigned to include greater options for automation, measurement and control. An enormous communications system will underlie the network of smart grid sensors and actuators. Devices will send messages to each other to coordinate control activity and formulate corrective strategies. The diversity and scale of this network will pose significant security challenges, especially since the number of entities charged with managing the grid will be large. A means for sharing information about cyber risks within the smart grid communications infrastructure is sorely needed. This paper proposes a strategy for sharing cyber security risks among smart grid stakeholders to enable them to identify attacks and mitigate their effects. The approach is inspired by the federated model, a cyber risk communications strategy employed by several U.S. national laboratories.