greetings my name is stefan stevenson
beau
and today i'm going to be discussing how
to detect attackers on your ics network
using your own measurements using a
technique known as state estimation
a little bit about me
i have eight years experience more or
less in infosec
i started off my career
with a power utility
it's a big one in the south
i'm educated as a mechanical engineer
but i've taught myself
pretty much everything i know
in infosec
and i currently work as a penetration
tester for coal fire federal
a little bit of background on ics
attacks
so attacks on critical infrastructure
are a thing now as i'm sure everyone is
aware
as control systems uh
continue to adapt more
common technology that are used in i.t
they open themselves up for all the
vulnerabilities that normal i.t systems
are prone to
the big difference is these systems are
hooked up to massive machines and things
that can kill people and cause major
disruptions to society
so
that's what we'll be talking about
today um for the purposes of this talk
i'm going to be dividing um attacks into
two types
one hard and fast
which we will not really be discussing
think uh
ddos ransomware things that are noisy
things that cause a lot of chaos
suddenly and are very obvious
instead we're going to be talking about
low and slow attacks so
think you know trojan backdoors anything
stuxnet anything where the attacker is
trying to
be stealthy and remain undetected
so traditional intrusion detection
you've got your ids's your firewall your
antivirus
um ddos mitigation that sort of thing
that those are all
things that are used commonly in it
but most utilities in my experience
stop there pretty much
when it comes to a lot of these security
products
their focus is on stopping them at the
it network before they can pivot onto
the network or just making it impossible
to pivot onto the network
by being disciplined about strict
segmentation between the two networks so
they can't get through
the shortcomings with this
these products and this approach is
that it
doesn't always work as we all know um it
doesn't really embrace the defense and
depth strategy
most technologies and problem with most
of these technologies is um
ot technologies like rtu's plc's ladder
logic controllers
they
you're not able to put a lot of these
technologies
onto these networks
one reason is because
they disrupt network performance
um and most net most engineers won't let
you put them on there because they'll
mess with things like reliability
latencies
uh jitter on the network um
and even if you could put them on
regulators like nerc
will often certify systems together as a
unit
and any kind of change like adding a ibs
or changing an antivirus signature
signature
could cause your
uh system to require being recertified
so
um is there an answer to this like is
there there really any uh better way
well i think there is
and it's physics
so the basic idea behind it is that uh
the laws of physics don't change
and neither do most ics systems they're
pretty much static they change very
little over time
power systems you know once they're set
up the actual physics behind how they
work
changes very little and often the
systems themselves change very little so
it gives you as a security professional
the opportunity to look more at a white
listing model which i know many people
cringe when they hear that but in this
case it's kind of appropriate because a
lot of these systems are very static
so state estimation you can think of as
sort of a numerical white listing model
so a little bit of background on state
estimation
it was a technique developed in the
power industry originally around the
1960s
it was not developed
for security because no one was thinking
about that back then but instead is more
of a way of ensuring reliability on the
grid
and preventing future blackouts by
detecting garbage data more quickly
but
for
given certain circumstances
gives us the chance to look at it as a
as a security
technique
so the basic idea behind state
estimation is you take raw raw
measurements from your sensors
you have a state estimator that you run
it through that gives you state
variables which the state variables feed
into your physics model which is similar
to the state estimator to give you
uh measurements that you would have
predicted
you then subtract those from the raw
measurements that you got and plug the
output into a chi-squared
distribution function which will give
you a probability that your measures
measurements are either garbage or being
tampered
with so there's no way around it this
talk is very math heavy
um i had to learn everything about
infosec on my own so
you know
infosec people can learn some math now
my chance for revenge
in more mathematical terms um they
basically have a bunch of measurements
which we give by the vector
z
and
we are trying to find state variables
x
that we can describe those z's in terms
of
um we for this technique to work because
it is a numerical method
we need more z's than x's um if the
sizes are equal or less than this
doesn't work because our system is
either fully constrained or under
constrained and we can't make a
prediction on whether or not our data is
good or bad
so uh to put that another way we compute
a system of functions
h of x which is a whole bunch of
functions that are comprised of our
state variables that give us our
measurements
so
since this is uh we have more uh
measurements than we do variables we
have you know n plus m unknown equations
and m equations we'll have more
um equations than unknowns which means
if there are more than one solutions to
this which means this becomes an
optimization problem
so
for the purposes of this talk we're
going to use the least squares method
there are other ways of solving this as
an optimization problem but least
squares is the most accurate
so
our goal for least squares is to
minimize j
which is nothing more than the sum
of the squares
of the differences between the
expected measurement
and the actual measurement
um oftentimes we'll put some kind of
weight
onto the measurements
that's basically a description of how
accurate is it is it's given by one over
sigma squared and sigma being the
standard deviation of the measurement
so the way we minimize j is the way we
minimize anything else by setting the
derivative with respect to the state
variables
equal to zero
now because um we're taking a derivative
we'll also need the derivative of h
um or the jacobian since it's
a matrix which we do nothing more by
just taking the partial derivatives with
respect to each of our x variables here
um i'm not going to go through the
entire derivation because for the
purposes of time
but essentially what you end up with is
an iterative method where you have an
initial value that you guess
subtracted by
uh some delta
and that gives you a next value x1 which
you then feed back into your x0 value to
repeat the algorithm over and over again
until your residuals end up being next
to zero
so once you figure out j
once you figure out j
you then figure out the probability that
the sum of the least squares
accurately reflects
the data you're getting
and this you get by putting in p for
zeta your probability for zeta
and your degrees of freedom
um here so obviously the more degrees of
freedom as you can see by this
um the cleaner an answer you'll get as
you can see we only have one degree of
freedom this doesn't really tell you a
whole lot right here whereas if you have
10
you get a much cleaner solution with
your most likely case being either close
to zero or close to one
um so you take one minus that
probability which will give you
your likelihood that the measurements
have been tampered with so a result of
one means that your measurements are
perfect and zero means that there's no
way those measurements can be accurate
but obviously for this to work we want
lots of accurate measurements with state
low standard deviations
uh so some basics about power because
we're talking about this in the context
of power because it was invented for
power systems
we primarily work in phasors we don't
really work very much in the time domain
because it makes the math a whole lot
easier
um
but otherwise
you'd have to work with complex signs
and cosines and stuff like that which is
really messy
you can basically think of a phaser as a
rotating vector
that rotates
counterclockwise
and has a offset and a magnitude
essentially from other vectors
so as you can see drake says use phasers
don't work in the time domain because it
makes your math
a whole lot easier
rather than having to figure out
voltage drops across inductors and
capacitors using a lot of complicated
calculus
so that does have consequences though
for our math we can no longer use the
simple equation
power equals voltage times current that
does not work anymore instead we have
three concepts now we have apparent
power real power and imaginary power
so your real power or your apparent
power is your voltage times the complex
conjugate of the current
which is broken into two components your
real power
which is what you think of when you
think of electricity and your imaginary
power which can kind of be thought of as
power that is basically being bounced
back into the grid because of things
like inductances and capacitances on
your load
the beer model is often used as a way of
thinking about it and optimizing this is
a
big part of being a transmission
engineer
so some basics on how the grid works um
power plant makes the power low voltage
stepped up to high voltage transmitted
at high voltage to a transmission
substation to distribution substation to
small transformers on poles to your
house
so a potential attack that we would
worry about you know on a simplified
grid like this is an attacker going
after something like a numerical relay
so i'm not going to explain like how an
attacker would do that because we're all
adults here and
thinking about malware on a on something
like a numerical relay running windows
ce is not something too far-fetched
but
essentially for the purposes of this
we're worried about an attacker who's
very subtly trying to change a setting
in either
the potential transformer or the current
transformer which would give a
bad voltage or current reading this is
this could be bad because it could cause
a relay to not break
um
when the voltage conditions are
dangerous or it could cause it to break
and cause disruptions when situations
are not dangerous neither of which is
ideal so
we're going to see if we can use state
estimation to detect this in a simple
example
so this is about the simplest example i
could come up with for state estimation
normally a real life state estimation
would be way more complicated than this
but for this we have a generator
and a bus
and two readings on one relay uh
power power and then two reeling
readings on the other one
for real and reactive power and a
voltage reading right here on a second
bus and a transformer sorry transmission
line in between the two
for the purposes of making the math
easier we're going to assume that the
power company is giving us uh the
voltage here so we don't need a sensor
and um that it's one that it's the
voltage is one and we know that for 100
degree uh certainty this makes the math
a bit easier so we call this a virtual
measurement essentially so we're not
taking this measurement it's just given
to us
and these are the other measurements
that our system is getting and we want
to know if these measurements are
legitimate or if they've been hacked
so first we need a set of equations to
describe the physics behind the system
so
we have our
first z our which is equal to our just
the voltage so that's
h1 equals v2 is pretty simple
um
the others we're taking the real part so
we have
four power measurements
power one two uh real power one two
reactive sorry real power one two
reactive power one two
real power two one reactive power two
one
um which is simply nothing more than the
formula we took earlier with real and
imaginary components taken respectively
so use just by using ohm's law we can
get the current we don't need to measure
directively just by taking the
differences between the
two voltage phasors and multiplying by
um the impedance on the line
through substitution we get
um
power one and two
um and then we take the real component
of it to get the real power on the first
on the first line
and then the imaginary power on the
sorry bus one
and then we can do the same thing to get
uh power on
real and imaginary power on
bus two
um now that we have our equations um and
we know v1 for a certainty
um
we can cancel it out and that makes our
equations form into this nice h matrix
that looks
like this
and now we have all of our equations in
two on so we have now two unknowns and
all our measurements in terms of that
um which are
delta two which is the
phasor offset
between voltage 1 and voltage 2. we can
just call since
delta is just a offset we can just
arbitrarily call one of them
zero which again makes our math easier
so we only have two state variables that
we need to know as opposed to one as
opposed to three
so now for optimization so as we recall
earlier our goal is to to minimize j
which
is simply the
h values minus the z values
squared and added together so it expands
out to this
using substitution with uh h that we
just got it expands out to this
big long and nasty
so then using the equation that we have
the algorithm that we came up with
earlier for least squares
and using this weighted matrix which is
just nothing more than a whole bunch of
weights in a diagonalized matrix uh to
make the matrix multiplication easier
um
we get this for our h for our jacobian
of our h equations
we now run the algorithm and the nice
thing about the least squares algorithm
is it's auto correcting
so you can start with any guess and it's
going to lead you in the right direction
so we start with the initial guess
of zero for the angle and one for the
voltage
we run it and we get our
first iteration we get this for x1
and this
for our residuals
and
while these residuals are low
we can probably do better it's always a
good idea when you have a non-linear
system to run the equation at least
twice
so we run it again
and we get this for our
x value sorry we use this as our input
for our x's and we run the equation we
run the algorithm again and we get this
for our second
iteration for our x values
and this for our residuals this looks a
lot nicer
so we then normalize these residuals by
dividing by the standard deviation
and we get this
so then it's the sum of the squares so
we square all of our normalized
residuals and get this
we add them all together and we get j
equals 20.76
so now we use that as input for our
chi-square matrix
using 20
20.76
as our input for the zeta
and our degrees of freedom
um as input for which line we should
follow and we get something that's up
here
so
for the amount of degrees of freedom
that's a pretty clean
clean answer that our data is definitely
being tampered with and somebody is
messing with
one of the values that our relay is
reading
okay well that's great but now how do we
discover who the culprit is
um well it's actually pretty simple
we can determine which sensor was bad
simply by throwing out measurements
and seeing if that lowers our j
um if it lowers our j then it's likely
that that measurement was the one that
uh
was messing us up but as you can see um
by this chart when you throw out
measurements you lose degrees of freedom
so now instead of
operating on the three line we're
operating on the two line so if you
don't have lots of redundant
measurements this isn't uh you won't get
a clean answer often
um
so using the previous example we start
with uh measurements that we think might
be um bad and there's really
no way to do it than just guessing so we
start off with z4 check that out we get
j equals 4.16
and
our new probability that we get is 12.5
by plugging it back into the
chi-squared equation so it could be that
one kind of unlikely
so then instead we try chucking out z5
and we get 18.21 for j
um
which is corresponds to 0.01 from the
chi-squared function
so it's probably not that
so instead we try z2 and we get
1.626 for our j
which gives us a 44.34
probability that the estimations now
make sense
so as i said before with two degrees of
freedom
you often won't get a clean solution but
it's most likely that z2
um was the measurement that had been
attacked or was being compromised since
this raises up the probability so
dramatically
so
this tells us that the attacker was most
likely
manipulating the reactive power reading
on bus one
so with higher redundancy again and
cleaner data we get a more definitive
measurement uh answer on what the
measurement is that is being attacked
so in summary
state estimation
you step one create a mathematical model
of the system you're trying to analyze
the states of
calculate the least squares estimates
for the state you're trying to estimate
based on
the given measurements
sum the squares to give you j calculate
1 minus the chi-squared test output
where v is your degrees of freedom
and look at the output and see if your
measurements make sense
so
uh benefits of state estimation are one
you're using measurements that you
already have that's probably the biggest
one so as far as defense and depth goes
this doesn't require
um doing any tricks to add you know
normal commercial off the shelf um i.t
security technology onto an ot system
which is a big plus and if you work in
the power system industry you already
have these um adb spider g load flow
siemens spectrum
there's lots of commercially available
state estimators out there for the power
industry that again were not designed
for security but could be potentially
utilized for security um it makes life
much more difficult for a attacker to be
stealthy if an attacker is attacking
your your uh sensors they have to be
uh especially if you have lots of
accurate redundant measurements
they need to be much more careful about
how they manipulate those measurements
to avoid detection
and
a big one too is you can use it on
legacy analog equipment
by doing you know some digital
conversion but uh legacy or analog
equipment
um it's a technology that can be used on
analog
so uh future work because this isn't
really something that's being used right
now for security anywhere that i've seen
and if somebody knows better please
correct me
is what would be the best way to build a
state estimator
we have ones that are commercially
available but maybe it's a better idea
to integrate the data we already have
into a data solution
you know like splunk or elastic or some
other sim or maybe it's better to build
it onto
splunk like a splunk app or an elastic
stack app or something like that there's
really no telling
the techniques are it's purely a
numerical technique
so
it could be deployed a numerous amount
of ways
there are lots of options so it's an
interesting
uh be interesting to see what we
discover
um can be used anywhere uh it because
it's again it's a numerical technique
any system that's roughly stable follows
the laws of physics
you can use
state estimation as a technique for
detecting an attacker
it's uh it's an ics
intrusion detection technique not just
useful
for power industry
the only real limitations are that the
system needs to be mostly static
once things start changing over 10 hertz
there are there's research into dynamic
state estimation
but it's by no means
a well-established technique
so is state estimation a silver bullet
of course not we're all adults here we
know that there are no silver bullets
so it does have drawbacks
um requires a
well understood documented
physical model of the system
lots of redundant measurements
and
you're only able to determine if the
data is actually garbage so you're not
actually able to determine if the data
is malicious
again this is why it works best in
industrial environments where you you
have knowledge that your sensors are of
to a certain degree reliable because the
manufacturer has told you that you have
a mean time to failure or a certain
standard deviation and it is what it
says it is
and not something else because you need
to be able to trust that your sensors
work
to a certain degree before using this
technique
um
additionally uh integrating state
estimation into security is pretty much
non-existent at this point
most sock teams have no idea how most of
the systems like is if they're defending
physical systems they often do not know
the physics or how the um the actual
physical system they're protecting works
and even if they did
there aren't any sins that have any
ability to build state estimation into
them easily
and the state estimators that do exist
have no easy way of being integrated
into security products
so of course the answer is teamwork um
engineers that understand phys state
estimation
and the physics behind what they're
doing need to work with the blue teamers
right
teamwork and leadership is the answer
that fixes this problem
because often you'll have people that
understand this stuff they just need to
to work together and by working together
they'll make us all safer
so special thanks to uh professor sakes
at uh georgia tech i used uh
some of his work in this presentation
and that's it i hope you've enjoyed this
presentation and i hope you learned a
lot