[论文解读] Co-Simulation Framework For Network Attack Generation and Monitoring

Oceane Bel, Joonseok Kim+4 more|arXiv (Cornell University)|Jun 30, 2023

Distributed and Parallel Computing SystemsComputer Science被引用 3

一句话总结

本论文提出 NATI[P]G，一种集成 GridLAB-D、HELICS 和 NS-3 的容器化联合仿真框架，可实现无需硬件的电力系统真实网络物理仿真。该框架展示了在应用层使用 DNP3 协议实施中间人攻击的场景，表明在攻击下电网型逆变器表现出更优的稳定性，且通过优化电容器和发电机参数设置，可在孤岛运行后两分钟内恢复频率。

ABSTRACT

Resilience assessment is a critical requirement of a power grid to maintain high availability, security, and quality of service. Most grid research work that is currently pursued does not have the capability to have hardware testbeds. Additionally, with the integration of distributed energy resources, the attack surface of the grid is increasing. This increases the need for reliable and realistic modeling techniques that are usable by the wider research community. Therefore, simulation testbeds have been used to model a real-world power grid topology and measure the impact of various perturbations. Existing co-simulation platforms for powergrid focus on a limited components of the overall system, such as focusing only on the dynamics of the physical layer. Additionally a significant number of existing platforms need specialized hardware that may be too expensive for most researchers. Finally, not many platforms support realistic modeling of the communication layer, which requires use of Supervisory Control and Data Acquisition communication protocol such as DNP3 while modeling cybersecurity scenarios. We present Network Attack Testbed in [Power] Grid (NATI[P]G), (pronounced natig), a standalone, containerized, and reusable environment to enable cyber analysts and researchers to run different cybersecurity and performance scenarios on powergrid. Our tool combines GridLAB-D, a grid simulator, HELICS, a co-simulation framework, and NS-3, a network simulator, to create an end-to-end simulation environment for the power grid. We demonstrate use cases by generating a library of datasets for several scenarios. These datasets can be used to detect cyberattacks at the cyber layer, and develop counter measures to these adverse scenarios.

研究动机与目标

• 解决现有电力系统网络物理系统联合仿真平台在支持真实通信层建模方面缺乏可访问、端到端支持的问题。
• 使研究人员能够在无需昂贵或专用硬件的情况下，模拟并分析复杂网络攻击（尤其是应用层攻击）对配电网的影响。
• 开发一个可重用的容器化测试平台，支持微电网和配电网的多样化网络安全与弹性评估场景。
• 提供来自模拟攻击场景的基准数据集，以支持入侵检测、风险评估和缓解策略开发等下游研究。
• 证明在对抗性条件下，能够对实际电网行为（包括频率稳定性和逆变器响应）进行建模。

提出的方法

• 集成 GridLAB-D 用于电力系统动态仿真，NS-3 用于网络层通信与攻击仿真，HELICS 作为联合仿真核心，实现跨仿真器的时间与数据同步。
• 在 NS-3 中使用 DNP3 协议命令（如修改 Pref 和 Qref 值）在应用层实现中间人攻击，模拟对逆变器控制的网络入侵。
• 使用拓扑配置文件定义电网结构，包括星型和环型拓扑，以评估不同网络配置下的攻击影响。
• 利用容器化技术（Docker）将 NATI[P]G 部署为独立、可重用且可移植的环境，供研究人员使用。
• 模拟电网孤岛事件，并测量在不同控制参数设置下频率偏差与电压稳定性。
• 从仿真器收集并分析时间序列数据，以检测攻击引发的异常并评估缓解策略。

Figure 1 : Overview of the co-simulation environment with interactions between HELICS, GridLAB-D and NS3. Each node uses the DNP3 protocol to communicate. The control center, where the Open Platform Communications (OPC) server is located, is responsible for control a region of the grid network. The

实验结果

研究问题

• RQ1 在中间人攻击期间，电网型逆变器与电网跟随型逆变器对被操纵的 Pref 和 Qref 值的响应有何不同？
• RQ2 当微电网因网络攻击而孤岛运行时，发电机与电容器的何种参数设置可使频率偏差最小化？
• RQ3 是否可在无需专用硬件的情况下，在联合仿真框架中有效建模与仿真基于真实 DNP3 的应用层攻击？
• RQ4 网络拓扑结构（如星型与环型）如何影响配电网中网络诱导扰动的传播与检测？
• RQ5 NATI[P]G 框架在多大程度上能够生成可复现、数据丰富的数据集，以支持网络弹性模型的训练与验证？

主要发现

• 电网型逆变器在面对被操纵的 Pref 和 Qref 值时表现出更优的弹性，成功将输出电压恢复至攻击前水平，而电网跟随型逆变器则更容易出现不稳定。
• 当发电机功率降低至 300 kW 且每相电容器容量增加至 600 kVAr 时，孤岛运行后约两分钟内频率即恢复至正常水平，表明该缓解策略有效。
• 在星型与环型拓扑中，采用相同优化后的发电机与电容器参数设置，均实现了相似的频率恢复效果，表明该缓解策略具有可扩展性。
• 在攻击期间，连接至逆变器 42 的负载电流波动更大，峰值更高、谷值更低，与星型拓扑中观察到的模式一致，表明攻击特征具有可重复性。
• 孤岛运行期间的频率响应表现为初始上升，随后缓慢攀升，最终在约 140 秒时趋于稳定，表明系统在攻击下具有动态恢复能力。
• 该框架成功实现实时数据流中网络攻击引发异常的检测，支持数据驱动型入侵检测系统的发展。

Figure 2 : Microgrid setup for experimentation, using the IEEE feeder model as described by Ashok et al. [ 8 ] . We use this setup to run the cyber attacks and collect data on how the attacks impact the performance of the power grid. The attack conducts a man-in-the-middle attack on two inverters in