This work describes DNP3, IEC-60870, IEC-61850 communication protocols and their implementing in SCADA systems. It further describes communication of these protocols between RaspberryPi as a slave device and Personal Computer as a master device.

Orientador: Alexandre Cezar Rodrigues da Silva / Resumo: A simulação de ambientes computacionais é uma das principais técnicas para estudo de protocolos, seu comportamento em redes de computadores e análise da segurança da informação. O acesso a ambientes reais para simulação de smart grids está restrito a poucas universidades e empresas assim como existem poucas ferramentas disponíveis para sua simulação computacional, o que dificulta a realização de pesquisas nesta linha. Neste trabalho objetiva-se a configuração de um ambiente para simulação do protocolo DNP3 utilizando exclusivamente ferramentas open source, utilizando-se técnicas de segurança ofensiva para realizar ataques a rede e então validar o comportamento da simulação e por fim realizar a integração do ambiente de simulação com equipamentos reais. Para isso, foi desenvolvido um testbed virtual através da integração e configuração de diversas ferramentas e softwares open source e posteriormente utilizados os equipamentos do Laboratório de Proteção do Campus III na UNESP de Ilha Solteira, expandindo as funcionalidades do simulador e obtendo um testbed misto com resultados promissores em todos os testes realizados. / Mestre

Submitted by ANDRÉ LUIZ LATANSIO DE OLIVEIRA null (andrelatansio@gmail.com) on 2017-08-03T12:48:20Z No. of bitstreams: 1 dissertacao_final_submeter.pdf: 6036596 bytes, checksum: debf9708c542db4157e83657c0859084 (MD5) / Approved for entry into archive by Luiz Galeffi (luizgaleffi@gmail.com) on 2017-08-03T17:52:18Z (GMT) No. of bitstreams: 1 oliveira_all_me_ilha.pdf: 6036596 bytes, checksum: debf9708c542db4157e83657c0859084 (MD5) / Made available in DSpace on 2017-08-03T17:52:18Z (GMT). No. of bitstreams: 1 oliveira_all_me_ilha.pdf: 6036596 bytes, checksum: debf9708c542db4157e83657c0859084 (MD5) Previous issue date: 2017-07-07 / A simulação de ambientes computacionais é uma das principais técnicas para estudo de protocolos, seu comportamento em redes de computadores e análise da segurança da informação. O acesso a ambientes reais para simulação de smart grids está restrito a poucas universidades e empresas assim como existem poucas ferramentas disponíveis para sua simulação computacional, o que dificulta a realização de pesquisas nesta linha. Neste trabalho objetiva-se a configuração de um ambiente para simulação do protocolo DNP3 utilizando exclusivamente ferramentas open source, utilizando-se técnicas de segurança ofensiva para realizar ataques a rede e então validar o comportamento da simulação e por fim realizar a integração do ambiente de simulação com equipamentos reais. Para isso, foi desenvolvido um testbed virtual através da integração e configuração de diversas ferramentas e softwares open source e posteriormente utilizados os equipamentos do Laboratório de Proteção do Campus III na UNESP de Ilha Solteira, expandindo as funcionalidades do simulador e obtendo um testbed misto com resultados promissores em todos os testes realizados. / The simulation of computational environments is one of the main techniques applied in the study of protocols, the behavior of those protocols in computer networks, and the analysis of information security procedures. Research in the area of smart grid simulation is hampered by the fact that few universities and companies have access to real environments, and further, that the number of computational tools available is limited. This paper therefore aims to configure an environment for the simulation of the DNP3 protocol using exclusively open source tools and by applying offensive security techniques including attacks which seek to exploit network vulnerabilities; subsequently, the proposed simulation behavior is validated. For this purpose, a virtual testbed was developed by integrating and configuring various open source software and tools and later using the Campus III Protection Laboratory equipments at UNESP Ilha Solteira, expanding the simulator functionalities and obtaining a mixed testbed with results promising in all tests performed.

This diploma thesis is focused on problematics of the industrial networks and offered security by the industrial protocols. The goal of this thesis is to create specific methods for detection of security incidents. This thesis is mainly focused on protocols Modbus/TCP and DNP3. In the theoretical part, the industrial protocols are described, there are defined vectors of attacks and is described security of each protocol. The practical part is focused on the description and simulation of security incidents. Based on the data gathered from the simulations, there are identified threats by the introduced detection methods. These methods are using for detecting the security incident an abnormality in the network traffic by created formulas or machine learning. Designed methods are implemented to IDS (Intrusion Detection System) of the system Zeek. With the designed methods, it is possible to detect selected security incidents in the destination workstation.

Made available in DSpace on 2014-12-17T14:55:38Z (GMT). No. of bitstreams: 1 TiagoHK.pdf: 2636025 bytes, checksum: ce24354f7859d7a6bcea2ea448265402 (MD5) Previous issue date: 2009-06-07 / This work presents a packet manipulation tool developed to realize tests in industrial devices that implements TCP/IP-based communication protocols. The tool was developed in Python programming language, as a Scapy extension. This tool, named IndPM- Industrial Packet Manipulator, can realize vulnerability tests in devices of industrial networks, industrial protocol compliance tests, receive server replies and utilize the Python interpreter to build tests. The Modbus/TCP protocol was implemented as proof-of-concept. The DNP3 over TCP protocol was also implemented but tests could not be realized because of the lack of resources. The IndPM results with Modbus/TCP protocol show some implementation faults in a Programmable Logic Controller communication module frequently utilized in automation companies / Neste trabalho ? apresentada uma ferramenta de manipula??o de pacotes destinada ? realiza??o de testes em dispositivos que implementam protocolos de comunica??o baseados em TCP/IP utilizados em redes industriais. A ferramenta foi desenvolvida em linguagem de programa??o Python, como uma extens?o ao Scapy. Esta ferramenta, denominada IndPM - Industrial Packet Manipulator, permite testar os dispositivos presentes em redes industriais em rela??o a poss?veis vulnerabilidades, realizar testes de conformidade de protocolos, coletar respostas de servidores existentes nas redes e utilizar os recursos do interpretador Python para compor testes. Como prova de conceito, foi implementado o protocolo Modbus/TCP. O protocolo DNP3 sobre TCP tamb?m foi implementado, mas n?o foi testado por indisponibilidade de recursos. Os resultados dos testes obtidos com a manipula??o de pacotes Modbus/TCP mostram falhas de implementa??o em um m?dulo de comunica??o para um Controlador L?gico Program?vel bastante utilizado na ind?stria

The use of smart grids is a reality in several developed countries, being a natural evolution for the electrical grids of any developing country, like Brazil. This evolution takes place through the interaction of communication systems with the electrical grids in a bidirectional communication of both data and energy flow using different protocols and communication technologies. Its validation occurs by the physical installation of equipments, or alternatively by computational simulators. This paper demonstrates through simulation the use viability of DNP3 (Distributed Network Protocol) encapsulated over TCP/IP over PLC (Power Line Communication). The network simulator software NS-2 was employed for PLC channel modeling and DNP3 implementation. Some quality parameters, such as packet loss, latency and thoughput, were evaluated under several scenarios. / A utilização de redes inteligentes de energia é uma realidade em diversos países desenvolvidos, sendo uma evolução natural para a rede elétrica de qualquer país em vias de desenvolvimento, como é o caso do Brasil. Essa evolução dá-se por uma interação dos sistemas de comunicação com as redes elétricas, em uma comunicação bidirecional, tanto de dados como de fluxo de energia, utilizando para isso protocolos e tecnologias de comunicação diferentes, cuja validação ocorre com uma instalação física dos equipamentos associados, ou, como alternativa, por simulação computacional. Este trabalho demonstra através de simulações a viabilidade do uso do protocolo DNP3 (do inglês Distributed Network Protocol) encapsulado em TCP/IP e em PLC (do inglês Power Line Communication) para aplicações em redes inteligentes, exceto para atividades que necessitem de comunicação em tempo real. Foram empregados o software de simulação de redes NS-2 para modelagem do canal PLC e do protocolo DNP3 e verificados parâmetros de qualidade, como perda de pacotes, latência e vazão de dados sob diversos cenários de aplicações. / São Cristóvão, SE

The advent of Information and Communications Technology (ICT) in power systems has revolutionized the monitoring, operation, and control mechanisms through advanced control and communication functions. However, this integration significantly elevates the vulnerability of modern power systems to cyber intrusions, posing severe risks to the integrity and reliability of the power grid. This dissertation presents the results of a comprehensive study into the detection of cyber intrusions and restoration of cyber-power systems post-attack with a focus on IEC 61850 based substations and recovery methodologies in the cyber-physical system framework. The first step of this study is to develop a novel Intrusion Detection System (IDS) specifically designed for deployment in automated substations. The proposed IDS effectively identifies falsified measurements within Manufacturing Messaging Specification (MMS) messages by verifying the consistency of electric circuit laws. This distributed approach helps avoid the transfer of contaminated measurements from substations to the control center, ensuring the integrity of SCADA systems. Utilizing a cyber-physical system testbed and the IEEE 39-bus test system, the IDS demonstrates high detection accuracy and validates its efficacy in real-time operational environments. Building upon the intrusion detection methodology, this dissertation advances into cyber system recovery strategies, which are designed to meet the challenges of restoring a power grid as a cyber-physical system following catastrophic cyberattacks. A novel restoration strategy is proposed, emphasizing the self-recovery of a substation automation system (SAS) within the substation through dynamic network reconfiguration and collaborative efforts among Intelligent Electronic Devices (IEDs). This strategy, validated through a cyber-power system testbed incorporating SDN technology and IEC 61850 protocol, highlights the critical role of cyber recovery in maintaining grid resilience. Further, this research extends its methodology to include a cyber-physical system restoration strategy that integrates an optimization-based multi-system restoration approach with cyber-power system simulation for constraint checking. This innovative strategy developed and validated using an Software Defined Networking (SDN) network for the IEEE 39-bus system, demonstrates the capability to efficiently restore the cyber-power system and maximize restoration capability following a large-scale cyberattack. Overall, this dissertation makes original contributions to the field of power system security by developing and validating effective mechanisms for the detection of and recovery from cyber intrusions in the cyber-power system. Here are the main contributions of this dissertation: 1) This work develops a distributed IDS, specifically designed for the substation automation environment, capable of pinpointing the targets of cyberattacks, including sophisticated attacks involving multiple substations. The effectiveness of this IDS in a real-time operational context is validated to demonstrate its efficiency and potential for widespread deployment. 2) A novel recovery strategy is proposed to restore the critical functions of substations following cyberattacks. This strategy emphasizes local recovery procedures that leverage the collaboration of devices within the substation network, circumventing the need for external control during the initial recovery phase. The implementation and validation of this method through a cyber-physical system testbed—specifically, within an IEC 61850 based Substation Automation System (SAS)—underscores its practicality and effectiveness in real-world scenarios. 3) The dissertation results in a new co-restoration strategy that integrates mixed integer linear programming to sequentially optimize the restoration of generators, power components, and communication nodes. This approach ensures optimal restoration decisions within a limited time horizon, enhancing the recovery capabilities of the cyber-power system. The application of an SDN based network simulator facilitates accurate modeling of cyber-power system interactions, including communication constraints and dynamic restoration scenarios. The strategy's adaptability is further improved by real-time assessment of the feasibility of the restoration sequence incorporating power flow and communication network constraints to ensure an effective recovery process. / Doctor of Philosophy / Electricity is a critical service that supports the society and economy. Today, electric power systems are becoming smarter, using advanced Information and Communications Technology to manage and distribute electricity more efficiently. This new technology creates a smart grid, a network that not only delivers power but also uses computers and other tools to remotely monitor electricity flows and address any issues that may arise. However, these smart systems with high connectivity utilizing information and communication systems can be vulnerable to cyberattacks, which could disrupt the electricity supply. To protect against these threats, this study is focused on creating systems that can detect when an abnormal condition is taking place in the cyber-power grid. These detection systems are designed to detect and identify signs of cyberattacks at key points in the power network, particularly at substations, which play a vital role in the delivery of electricity. Substations control the power grid operating conditions to make sure that electricity service is reliable and efficient for the consumers Just like traffic lights help manage the flow of vehicles, substations manage the flow of electricity to make sure electric energy is delivered to where it needed. Once a cyberattack is detected, the next step is to stop the attack and mitigate the impact it may have made to ensure that the power grid returns to normal operations as quickly as possible. This dissertation is concerned with the development and validation of analytical and computational methods to quickly identify the cyberattacks and prevent the disruptions to the electricity service. Also, the focus of this work is also on a coordinated recovery of both the cyber system ( digital controls and monitoring) and power system (physical infrastructure including transformers and transmission and distribution lines). This co-restoration approach is key to sustain the critical electricity service and ensures that the grid is resilient against the cyber threats. By developing strategies that address both the cyber and physical aspects, the proposed methodology aims to minimize downtime and reduce the impact of large-scale cyberattacks on the electrical infrastructure. The impact of the results of this dissertation is the enhancement of security and resilience of the electric energy supply in an era where the risks of cyber threats are increasingly significantly. Overall, by developing new methodologies to detect and respond to cyberattacks, the cyber-power system's capability to withstand and recover from cyberattacks is enhanced in the increasingly technology-dependent power grid environment.

Orientador: Nunzio Marco Torrisi / Dissertação (mestrado) - Universidade Federal do ABC. Programa de Pós-Graduação em Ciências da Computação, 2014

This work deals security of SCADA industry systems which are used in energetic networks. It describes architecture of those systems and also analyze in details two communication protocols -- DNP3 and IEC 60870-5-104.  Next part is devoted to the analysis of anomaly and security threats which can be happen in SCADA systems. The main goal of this work is design and implementation of system which will be able to detect some of threats or anomalies. Also is necessary to propose simulation environment for testing.

A thesis which models the DNP3 and IEC 61850 protocol in OPNET / Supervisory Control and Data Acquisition (SCADA) is a critical part of monitoring and controlling of the electrical substation. The aim of this dissertation is to investigate the performance of the Distributed Network Protocol Version 3.3 (DNP3) protocol and to compare its performance to that of International Electro-technical Commission (IEC) 61850 protocol in an electrical substation communication network environment. Building an electrical substation control room and installing the network equipment was going to be expensive and take a lot of time. The better option was to build a model of the electrical substation communication network and run simulations. Riverbend modeller academic edition known as Optimized Network Engineering Tool (OPNET) was chosen as a software package to model substation communication network, DNP3 protocol and IEC 61850 Protocol stack. Modelling the IEC 61850 protocol stack on OPNET involved building the used Open System Interconnection (OSI) layers of the IEC 61850 protocol stack onto the application definitions of OPNET. The Transmission Control Protocol/Internet Protocol (TCP/IP) configuration settings of DNP3 protocol were also modelled on the OPNET application definitions. The aim is to compare the two protocols and determine which protocol is the best performing one in terms of throughput, data delay and latency. The substation communication model consists of 10 ethernet nodes which simulate protection Intelligent Electronic Devices (IEDs), 13 ethernet switches, a server which simulates the substation Remote Terminal Unit (RTU) and the DNP3 Protocol over TCP/IP simulated on the model. DNP3 is a protocol that can be used in a power utility computer network to provide communication service for the grid components. DNP3 protocol is currently used at Eskom as the communication protocol because it is widely used by equipment vendors in the energy sector. DNP3 protocol will be modelled before being compared to the new recent robust protocol IEC 61850 in the same model and determine which protocol is the best for Eskom on the network of the power grid. The network load and packet delay parameters were sampled when 10%, 50%, 90% and 100% of devices are online. The IEC 61850 protocol model has three scenarios and they are normal operation of a Substation, maintenance in a Substation and Buszone operation at a Substation. In these scenarios packet end to end delay of Generic Object Oriented Substation Event (GOOSE), vi © University of South Africa 2020 Generic Substation Status Event (GSSE), Sampled Values (SV) and Manufacturing Messaging Specification (MMS) messages are monitored. The throughput from the IED under maintenance and the throughput at the Substation RTU end is monitored in the model. Analysis of the results of the DNP3 protocol simulation showed that with an increase in number of nodes there was an increase in packet delay as well as the network load. The load on the network should be taken into consideration when designing a substation communication network that requires a quick response such as a smart gird. GOOSE, GSSE, SV results on the IEC 61850 model met all the requirements of the IEC 61850 standard and the MMS did not meet all the requirements of the IEC standard. The design of the substation communication network using IEC 61850 will assist when trying to predict the behavior of the network with regards to this specific protocol during maintenance and when there are faults in the communication network or IED’s. After the simulation of the DNP3 protocol and the IEC 61850 the throughput of DNP3 protocol was determined to be in the range (20 – 450) kbps and the throughput of IEC61850 protocol was determined to be in the range (1.6 – 16) Mbps. / College of Engineering, Science and Technology / M. Tech. (Electrical Engineering)