Communications of the ACM
Engineers se Game Theory to Quantify Threats of Cyberattacks on Power Grid
Threat levels for cyberattacks on the U.S. power grid are usually labeled high, medium, or low. That's not good enough for a team of Iowa State University engineers.
That's too qualitative and too subjective, says Manimaran Govindarasu, Iowa State's Ross Martin Mehl and Marylyne Munas Mehl Computer Engineering Professor.
And, as he and his research collaborators write in a summary of a project to develop a better way to assess the threats of cyberattacks on the power grid, current assessments are "grossly inadequate" to account for dynamic and uncertain adversaries and the complexity of the computer controls and networks that support the grid.
"Can we do this in a quantitative way?" Govindarasu asks.
Could engineers incorporate scientific methods? Computer algorithms? And given that there are attackers and defenders—just like in a soccer match—could game theory be applied to help with risk assessment, attack-defense modeling, and "what-if" contingency analysis that could help mitigate any attacks?
A three-year, $777,271 grant from the U.S. National Science Foundation is supporting research and development of the idea. Govindarasu is leading the project with the collaboration of Sourabh Bhattacharya, an Iowa State assistant professor of mechanical engineering. Iowa State doctoral students Srayashi Konar, Hamid Emadi, and Burhan Hyder are contributing to the project.
"We want to prove this concept is doable," Govindarasu says. "And we want to develop a software tool industry can use—one that provides a systematic way of security planning and investment."
The key will be developing models that analyze and predict threats, vulnerabilities, and consequences, Govindarasu says. Of those, threat modeling is the least understood. He thinks game theory could change that.
Bhattacharya has expertise in game theory and is using it for other projects related to drones and multi-robot systems.
Bhattacharya says game theory is all about quantifying how people or teams try to maximize their outcomes—whether that's scoring soccer goals or defending the power grid from cyberattacks.
"We can use game theory tools to figure out what we can expect from such interactions," he says.
The primary tools are mathematical models that measure "optimality," or "what's the best I can do?" in any given scenario, Bhattacharya says.
In the case of the power grid, operators want to keep their computers and controls safe behind firewalls with strong authentication and access-control mechanisms. Attackers want to evade those protections and bring down the grid.
"They fight against each other," he says.
That fight can be modeled to show how and where the grid is vulnerable to cyberattacks, Bhattacharya says. "That's a powerful tool to develop strategies to protect the system. Given a fixed budget for security, it can show whether your need better locks in the 'windows' or the 'doors,'" he says.
developing tools to protect the power grid from cyberattacks.
Developing a useful tool for industry is an important part of the project. Govindarasu has long worked with industry on cybersecurity, including deployment of technologies and sharing lessons and training on the "PowerCyber" grid testbed developed at Iowa State. Iowa State's Electric Power Research Center will also be involved in demonstrating and sharing the tools.
The study's tools could also be adapted to other cyber-physical infrastructure such as oil, natural gas, and transportation systems.
"We need to work hard to make something happen," Govindarasu says. "We need to figure out how we can take this into the field because cybersecurity is a real problem."
No entries found