Grid-context checks catch credentialed DER writes static checks miss
Original title: Checking DER Commands Against Grid Context Catches Credentialed Attacks Static Checks Miss
On two IEEE feeders, the check refused 91.7% of insider-abuse writes while denying 1.28% of benign writes.
The paper adds a check that judges each distributed energy resource write against feeder operating context, including nearby voltages, hour, day-ahead price, load and irradiance, using the feeder's own benign history. A lookup trained on that history catches none of four scenarios that send values already familiar on the targeted device. Live evaluation uses the IEEE 123-bus and 8500-node feeders and a measured 2024 year of price, load and irradiance across nine attack scenarios.
- The context check refused 64.4% of DER-aggregation writes.
- Offline, it refused 47.3% and 50.5% of curtailment setpoints on the two feeders.
- Without context, the same offline check refused 18.5% and 16.0%.
- Live tests of a few mostly shallow setpoints were mostly allowed.
From the original article
1 min read at arxiv.orgAuthorization of distributed energy resource (DER) commands judges a command by who sent it and whether its value has been seen before. An attacker holding a legitimate credential who writes ordinary values passes both tests.
By Benjamin Blakely · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.