Analysis Of False Data Injection Attacks On IEC 61850 In Digital Substation

This repository contains the supplementary materials for a thesis on the analysis of False Data Injection (FDI) attacks within a Digital Primary Substation (DPS). It focuses on the vulnerabilities of the IEC 61850 standard and the GOOSE communication protocol. The materials provided are intended to support the reproducibility and transparent auditing of the methodology, implementation, and results.

Repository Structure

• /ATTACKER: Contains files related to the C2_Delay attack. Important to recompile the fdi_goose.c when editing.

• /Analysis_Results: Contains Python scripts for analyzing the collected data.

• /PNG: Contains the output plots and charts generated by the analysis scripts.

• /icons: Contains icons used for the network topology diagram.

• /trials: Contains the raw network capture data (.pcapng files) from the experiments, organized into different scenarios.

• /C0_Baseline_meta.sh: Contains the script to compute the SHA256, check for duplicates, and add starting time that will output the metadata.

• Topology_draw.io: Contains the network topology used.

• autocapture_fixed.sh: Contains the script used to capture the network traffic for all the datasets

• packets_check.sh: Contains the script to check for duplicates within the PCAP files.

• Topology.drawio.pdf: A PDF of the network topology used in the simulation.

Dataset

The experimental data is located in the /trials directory. The data is divided into three distinct scenarios, each containing multiple trial runs in .pcapng format.

• C0_Baseline: Contains captures of normal network traffic, serving as a baseline for comparison.
• C1_FDI: Contains captures of traffic during a False Data Injection (FDI) attack.
• C2_Delay: Contains captures of traffic during a packet delay attack.
• C2_Delay:the fdi_goose.c program was modified to prompt the user to enter a numerical value. This file is added in the ATTACKER folder.

Each scenario directory also contains:

• *.meta.json: A JSON file cataloging the .pcapng files for that scenario, including hashes and start times.
• pcap_to_csv.sh: A shell script to convert the .pcapng files into a single .csv file for analysis.
• *.csv: The resulting CSV file from the conversion script.

Dataset Capture

• ./autocapture_fixed.sh C0_Baseline/Baseline01 baseline 120 DPSRS-eth5
• ./autocapture_fixed.sh C0_Baseline/Baseline02 baseline 120 DPSRS-eth5
• ./autocapture_fixed.sh C0_Baseline/Baseline03 baseline 120 DPSRS-eth5
• ./autocapture_fixed.sh C0_Baseline/Baseline04 baseline 120 DPSRS-eth5
• ./autocapture_fixed.sh C0_Baseline/Baseline05 baseline 120 DPSRS-eth5: this process must be repeated across ten runs per condition pointing to the location where the datasets can be stored.

Analysis

• The analysis of the dataset is performed using the Python scripts in the /Analysis_Results directory but first it must installed the .env environment.
• sudo apt-get install python3-venv
• python3 -m venv venv: this command creates the venv directory to hold the virtual environment, and -m is the flag telling Python to run a module as a script such as venv module.
• source venv/bin/activate: now the environment must be activate
• python3 per_run_analysis.py: this command must be run from the venv environment and the python file program must be located here. Once run it will create the 2d graphs for analysis.

1. Data Conversion:

• pcap_to_csv.sh script in each scenario directory should be run first to convert the raw .pcapng files into a .csv file. This script uses tshark to extract relevant fields from the packet captures.
• python3 pcapng_csv.py '/home/luk3/Desktop/SGSim/C0_Baseline/Baseline01/baseline_DPSRS-eth5_20260123_220816.pcapng' output.csv

2. Analysis Scripts:

• Analysis_Results/analysis.py: This script loads the .csv files, performs data analysis, and generates several plots to visualize the results.
• Analysis_Results/pca_analysis.py: This script performs Principal Component Analysis (PCA) on the dataset.

3. Analysis Output: The plots generated by the analysis scripts are saved in the /PNG directory. These include:

• delay_analysis.png
• goose_value_distribution.png
• packet_frequency.png
• pca_2d_plot.png

Simulation Environment (SGSim)

• The experiments were conducted in a simulated environment using SGSim.

Pre-requisites (can be installed with sudo apt-get command)

• mininet
• sqlite3
• php-sqlite3
• tshark
• pandas
• numpy
• matplotlib.pyplot
• seaborn

Installation

Extract comlib_dps.zip and comlib_dss.zip in the same folder. (Note: these files can be found here: https://github.com/filipholik/SmartGridSim/blob/main/comlib_dps.zip).

• sudo apt-get install mininet
• sudo apt-get install sqlite3
• sudo apt-get install php-sqlite3
• sudo apt-get install tshark

Running the Simulation

• Topology: ./StartSGTopology.sh
• Available commands: mininet> help (commands starting with sgsim_ were added to Mininet, use help command for description)
• GUI: ./GUI/StartGUI.sh
• SCADA simulation: open web browser at localhost:8000

Running the PCA Analysis

• sudo apt-install -y python3-venv
• python -m venv venv: in your terminal, replacing "myenv" with your desired environment name
• source venv/bin/activate: to activate the environment
• pip install -U numpy pandas matplotlib seaborn
• python3 pca_analysis.py : run the script to load the datasets, explicitly defining frame.time as string to avoid parsing issues

Mininet is able to control the topology using custom functions

• sgsim_startcom_goose: starts the GOOSE communication between the IED1, IED4 and the DPS HMI.
• sgsim_attack_goose_fdi: starts the FDI attack from the attacker device inside the DPS.
• sgsim_startcom_sv: starts the SV communication between IED2, IED3 and the DPS HMI.
• sgsim_startperfmon: starts the IEC104 communication between the same devices, and timestamps to measure and list the delay, IPDV jitter, packet loss and threshold above 60 s measurement.
• sgsim_attack_dos: starts the DoS attack from the DSS1 RTU to the CONTROL device (assumes compromised RTU).