Peraton Labs

Utilities rely on Smart Grid wireless field networks to perform meter reading for electric, water and gas service, connect/disconnect operations, load management and to manage smart streetlights. These wireless field networks exist everywhere, operate 24 -7, and have increasingly become a desirable cyber target as they present opportunities for hackers to steal information and disrupt or deny service using low-cost software defined radios.

Since more than 90% of all wireless field network traffic is invisible to traditional back-end monitoring operations systems, utilities need a smart way to detect threats and monitor network operations for service assurance.

SecureSmart is an integrated cybersecurity, operations and engineering solution for advanced metering infrastructure (AMI) and Distribution Automation (DA).  SecureSmart uses a sparse network of patented wireless field sensors to passively capture and analyze over-the-air traffic. With Peraton Labs “follow-me” technology, SecureSmart monitors all channels simultaneously in multichannel, multi-data rate Smart Grid systems.  The sensors are strategically installed on utility poles, substations, buildings, and towers.  GPS-enabled mobile sensors can be installed in in fleet vehicles to provide added service territory coverage and create a mobile troubleshooting platform.   SecureSmart sensors use a separate, secure, backhaul network to avoid consuming service network bandwidth or gateway resources.  Sensor intercept range is effectively extended by the relaying behavior within mesh networks.  SecureSmart sensors can be configured for full-or sampling operation.

The SecureSmart™ solution provides unique technology to monitor and protect utility applications by delivering threat detection, situational awareness, and network performance monitoring. SecureSmart defends meter-to-cash, from cyber intrusion, monitors the privacy of rate payer information, and supports network operations and system optimization to ensure reliable secure utility services.

SecureSmart is the industry leading AMI field network monitoring solution, providing real-time network health, anomaly detection, security analysis and visualization.  SecureSmart delivers live field traffic and views of device interaction, real-time packet dissection starting at the radio level, ground-truth visibility and cybersecurity threat detection that enables infrastructure operators to answer critical questions such as:

• Is my smart infrastructure under attack or leaking sensitive information?
• Why are certain areas prone to meter read problems and underperforming?
• Is there a source of ground truth information to investigate distribution automation mis-operation events?
• Can my existing infrastructure support new applications or increased interval data reads?
• Can I mange my multi-service network to a performance standard?

Key SecureSmart benefits:

• Ground-truth network visibility using an easy-to-deploy, independent, sensor-based architecture
• Continuously validates wireless cybersecurity controls
• Monitors key service assurance metrics for multi-application smart grids
• Supports field network troubleshooting, performance monitoring and provides network buildout tools for service territory expansion

Key SecureSmart capabilities:

• Live traffic intercepts with decomposition from physical through application layers
• Deep packet inspection using custom threat detection models based on experience-driven findings and offensive systems security analysis of proprietary and standards-based protocols
• Real-time traffic profiling of key security, network, and service performance indicators for AMI and DA infrastructure
• Network analytics and visualization tools construct logical and GIS-based traffic routing maps

Across America, utilities are using SecureSmart as an operator run licensed product or as a hosted service managed by Peraton Labs to defend metering and distribution automation services against cyberattacks, ensure the security of ratepayer information, keep advanced distribution operations running smoothly, and to troubleshoot and optimize field networks to support managed multi-service delivery. Visit www.peratonlabs.com/market-energy.html for more information.

EnergyDefender provides innovative technologies to assess the cyber trustworthiness of real-time SCADA assets by introducing “non-Transmission Control Protocol (TCP)” channel sources to deliver timely, concrete, and objective evidence to attest to cyber integrity. EnergyDefender uses a multi-axis approach that analyzes cyber emissions, binary integrity, and the engineering reasonableness and validation of running settings in conjunction with protocol and traffic analysis to support of defensive cyber operations and hunt cyber-weapons in SCADA environments. It collects independent telemetry and provides intervention solutions to defend and recover from a cyberattack. Its vector analysis components run concurrently to assess cyber emissions, binary integrity, device configuration and power telemetry consistency in conjunction with protocol and traffic analysis. The results are united through a probable cause, threat-reasoning engine that provides guidance on malicious scenarios.

The Asset Readiness HMI, system operators are provided with a suite of active scan diagnostics and recovery tools to inspect the binary integrity of relays and Linux- and Windows-based RTUs and relays, validate and compare relay configurations, perform a reasonable engineering analysis on relay settings independent of the configuration of record and issue relay commands and emergency control operations from a central interface. EnergyDefender performs novel, passive cyber emission analysis of control systems RF and side-channel emanations from protection systems and applies machine learning to determine if processor code execution has changed from known baselines to detect the presence of malware.

The Cyber Emissions Monitor (CEM) is a non-intrusive, side channel anomaly detection system that assesses the real-time integrity and operational state of protection system equipment based on monitoring of device radio frequency (RF) emissions. All electronic processors produce unintended emanations during normal operation, such as power fluctuations, electromagnetic leakage and sound. CEM uses machine learning to analyze RF emissions, correlate emissions with device behavior, and detect anomalies. As a fully air-gapped solution, CEM performs covert detection of compromises—a hacker cannot tell that equipment is being monitored, much less infiltrate the monitoring system for nefarious purposes.

CEM uses a small antenna known as CyberStraw that attaches to a device serial port.  The CyberStraw collects weak RF emissions produced by the controller’s processor as it executes its program instructions.  The sequence of instructions, memory access and I/O operates performed by the controller generate a unique time-based spectral pattern.  Through advanced signal processing and machine learning techniques, CEM distills the principal components of observed patterns to identify various modes of normal behavior in a baseline model.  Once the model is created, CEM continuously monitors the device’s emissions, classifies its model behavior and compares against the established baseline.  If there are sufficient model behavior differences, an alert is generated to warn of a device anomaly.  To view a video demonstration of the cyber emissions monitor, visit: https://www.peratonlabs.com/market-energy.html