On Holistic Multi-Step Cyberattack Detection via a Graph-based Correlation Approach

TL;DR

This paper presents a graph-based correlation method for detecting multi-stage cyberattacks in power grids, leveraging heterogeneous data and alert correlation to identify orchestrated attack sequences.

Contribution

It introduces a novel multi-step attack detection framework using a knowledge base and model-based alert correlation tailored for power grid cyber security.

Findings

Effective detection of multi-stage attacks demonstrated in a power grid case study.

The approach improves situational awareness by correlating heterogeneous alerts.

Enhanced early warning capabilities for orchestrated cyber campaigns.

Abstract

While digitization of distribution grids through information and communications technology brings numerous benefits, it also increases the grid's vulnerability to serious cyber attacks. Unlike conventional systems, attacks on many industrial control systems such as power grids often occur in multiple stages, with the attacker taking several steps at once to achieve its goal. Detection mechanisms with situational awareness are needed to detect orchestrated attack steps as part of a coherent attack campaign. To provide a foundation for detection and prevention of such attacks, this paper addresses the detection of multi-stage cyber attacks with the aid of a graph-based cyber intelligence database and alert correlation approach. Specifically, we propose an approach to detect multi-stage attacks by leveraging heterogeneous data to form a knowledge base and employ a model-based correlation approach on the generated alerts to identify multi-stage cyber attack sequences taking place in the network. We investigate the detection quality of the proposed approach by using a case study of a multi-stage cyber attack campaign in a future-orientated power grid pilot.