Energy Systems Division

Renewables and Grid Modernization

Grid Cybersecurity Research

Brookhaven Lab supports grid cybersecurity research for the Department of Energy Office of Cybersecurity, Energy Security and Emergency Response (CESER) and other DOE Offices through the following projects.

AIERCI Tool to Ensure Uninterrupted Energy Flow from Cyber Attacks Targeting Essential Forecasting Data for Grid Operations (2016 – 2021)

Funded by the DOE Cybersecurity for Energy Delivery Systems (CEDS) Program in the Office of Cybersecurity, Energy Security, and Emergency Response (CESER)

Objective

The objective of this project was to design, develop, and demonstrate the Assess the Impact and Evaluate the Response to Cybersecurity Issues (AIERCI) tool which is needed by utilities. This online tool can assess the impact and evaluate the response to a cyber threat on forecasting data used to operate energy delivery systems by 1) detecting and mitigating anomalies caused by cyberattacks targeting essential forecasting data for loads and renewables, 2) providing a cyber resilient forecasting scheme, and 3) evaluating the impact of cyberattacks targeting forecasting data on grid scheduling functions and operation. In addition, the tool accounts for the impacts of compromised distributed energy resources (DERs) on the transmission network in terms of both forecasting and dynamic security assessment.

Approach

The methodology used to develop this tool consists of cyber issue identification, evaluation of possible responses on the operational forecasting using mathematical models and tools, and determination of the outcome of the response. The overall technical approach, which is illustrated in the figure below, includes the following elements:

1. identifies types of data sets, sources, the communication standards, protocols, and media, and storage for such data required by the forecasting models for operational planning or operation
2. understands and identifies the potential vulnerability, exploit potential, and exposure in data flows between forecasting input and grid operation
3. identifies the potential means for compromising the forecasting input and output data
4. propagates the cyberattack by feeding the tampered data to the forecasting model(s) and/or the scheduling functionalities for grid operation and determining the impacts or consequences on the grid operation, or the risk measures.

Technical Approach for AIERCI Tool.

Achievements

1. Anomaly detection and mitigation (AD&M) module: The AD&M module is based on integrated model- and data analytics-based methods (MBM and DABM) for anomaly detection and mitigation (AD&M) in input data such as load and weather for forecasting functions. The developed AD&M methods have been demonstrated to be highly effective in detecting and mitigating input data anomalies.
2. Ensemble Approach (EA) module: The EA module includes adversarial machine learning (AML) and adaptive robust regression (ARR) that are used for a cybersecure load forecasting scheme. Different forecasting schemes may have different strengths and different sensitivities to corrupted or compromised input data.
3. Impact Assessment of Scheduling Functions (IASF) module: The IASF module evaluates scheduling functions of different time scales, including day-ahead unit commitment, real-time economic dispatch, and load frequency control to measure the impacts of cyberattacks and the performance of detection and mitigation strategies on grid operation.

The MBM and the weather data related anomaly detection tools have been adopted by a generation and transmission electric cooperative.

An online AIERCI tool that implements these three functional modules has been developed. To ensure the security of the AIERCI tool itself, it was developed by adopting a “security-by-design” approach. AIERCI tool is hosted in a GitHub repository. Access can be obtained by contacting Meng Yue.

Deep Learning Malware (2020 – 2023)

Funded by multiple DOE Offices and coordinated by the Grid Modernization Laboratory Consortium (GMLC).

Project Team

Objective

Once malware is released, other adversaries can repurpose it for their own intentions. The threat evolves and the code remains. Malware is not characterized for the energy sector domains. Pattern matching is static and void after slight changes. Source code for malware is rare requiring lengthy binary analysis and reverse engineering (RE) processing. Malware impacts all applications in the bulk electric system. The objective of this project is to

• Develop malware indicators based on code-behavior for 3 energy domains
• Better understand structured threat: Visual, Sharable, Actionable, and Implementable (IT/OT)
• Resolve all Possible Paths/Constraints for the Malware in days, not years
• Use recent machine learning (ML) concepts to characterize malware for more robust detection based on malware code-behavior, described in a structured threat for energy sector domains.

Tools Developed

ESE (Enhanced STIX Elevation) tool