Electric utilities are currently installing wide area monitoring systems which include phasor measurement units (PMU) and phasor data concentrators (PDC). The IEEE C37.118 protocol is used for network communication between these devices. Protocol mutation attacks against this protocol can lead to denial of service and a loss of visibility of the state of the power system. This paper is a preview of a set rules developed to proactively monitor for protocol mutation attacks against the IEEE C37.118 protocol. Eleven rules were described in this paper. A total of 36 rules have been developed. This paper also describes validation of the rules and proposes and architecture for implementing the rules in a utility network.
['Read Sprabery', 'Thomas H. Morris', 'Shengyi Pan', 'Uttam Adhikari', 'Vahid Madani']
Protocol mutation intrusion detection for synchrophasor communications