IEEE TRANSACTIONS ON SMART GRID, VOL. 2, NO.

4, DECEMBER 2011 827

An Early Warning System Based on Reputation for

Energy Control Systems
Cristina Alcaraz, Member, IEEE, Carmen Fernandez-Gago, and Javier Lopez, Member, IEEE

AbstractMost of energy control or Supervisory Control and protect the rest of the system as a whole. We agree with [2]
Data Acquisition (SCADA) systems are very dependent on ad- that part of this security must be focused on the prevention of
vanced technologies and on traditional security mechanisms for anomalous events and the preview of any significant change
protecting the a system against anomalous events. Security mech-
anisms are not enough to be used in critical systems, since they
that can cause a cascading effect over other domains of the
can only detect anomalous events occurring at a certain moment smart grid or over other critical infrastructures (CIs) [3]. For
in time. For this reason it becomes of paramount importance this reason, we propose an intelligent early warning systems
the usage of intelligent systems with capability for preventing (EWS) able to protect the substations as independent subdo-
anomalous situations and reacting against them on time. This type mains, but indirectly protecting the rest of domains of a smart
of systems are, for example, early warning systems (EWS). In this grid when serious failures occur.
paper, we propose an EWS based on Wireless Sensor Networks
(WSNs) (under the ISA100.11a standard) and reputation for con-
Unfortunately, up to date there are not specialized EWSs
troling network behavior. The WSN are organized into clusters for critical environments and therefore researching in this new
where a cluster head (CH) is designated. This CH will contain a area is very much needed in order to protect the system against
Reputation Manager Module. The usability of this approach is also anomalous events, failures or threats. The approach we present
analyzed considering a smart grid scenario. in this paper tries to fill this lack. We introduce a model of
Index TermsEarly warning systems, reputation, SCADA sys- an EWS that covers this security aspect for energy control
tems, smart grid, wireless sensor networks. systems. The approach is based on wireless sensor networks
(WSNs), able to perceive the real state of the infrastructure, on
reputation to control the real behavior of the control network
I. INTRODUCTION and on the ISA100.11a standard [4] for an efficient alarm
management. Moreover, the approach is able to detect specific
A CCORDING to the conceptual model described by NIST
in [1], part of the functionality of a smart grid is associ-
ated to the remote control of power substations that ensure an
anomalous behaviors from sensor nodes, and in particular be-
haviors associated to compromised situations, such as a replay
or a delay attack.
efficient energy generation and distribution to residential com-
The paper is organized as follows. Section II analyzes the
plexes. The control is basically managed by a centralized system
need of EWSs in highly critical energy scenarios and it identi-
known as Supervisory Control and Data Acquisition (SCADA)
fies the main components of them. Section III provides a back-
system. Although this control form a unique entity, it has a spe-
ground about WSN and reputation systems in WSNs and crit-
cial influence on the rest of domains by supervising operational
ical infrastructures. Section IV presents the general architec-
activities and residential complexes.
ture of our model, which includes a set of components, together
However, this type of interaction among domains could
with their respective modules and functionalities. In Section V
trigger in serious consequences when part of the control and
our model is analyzed in a critical application context, such as
substations are disrupted. Then it is crucial to address problems
a smart grid, and in Section VI implementation details of the
of the current SCADA systems to strengthen its architecture,
model are given. Finally, Section VII concludes the paper and
and thus to ensure a reliable and survivable smart grid. In fact,
outlines the future work.
most of the security mechanisms applied in SCADA systems
are not based so far on dynamic and autonomous procedures II. EARLY WARNING SYSTEMS IN THE CASCADING
where different entities with different complexities are inte- EFFECT CONTROL
grated in the same context. It is necessary to provide advanced
The protection of critical infrastructures in our society such
security mechanisms to individually protect domains, and thus
as energy generation and distribution systems has been proven
of paramount importance. Some national and international ac-
Manuscript received October 14, 2010; revised April 01, 2011; accepted tion plans and initiatives have already been proposed in order
June 05, 2011. Date of publication November 09, 2011; date of current version
November 23, 2011. This work was supported in part by ARES under Project to discuss some security issues related to critical infrastructures
CSD2007-00004, in part by SPRINT under Project TIN2009-09237), the protection (CIP). Even though modeling and simulation tech-
latter also cofunded by FEDER and the EU under the Information and Com- niques are feasible mechanisms to visualize the connectivity
munication Technologies (ICT) theme of the 7th Framework Programme for
R&D FP7) under Project NESSoS (FP7 256890). The work of C. Alcaraz was
among systems and assess risks, they are not enough to ensure
supported by the Spanish FPI (Formacion de Personal Investigador) Research an effective control of a cascading effect. It would be desirable
Programme. Paper no. TSG-00161-2010. to predict and anticipate anomalous situations, even before they
The authors are with the Computer Science Department, University
of Malaga, 29071 Malaga, Spain (e-mail: [email protected]; mc-
happen in order to react against them, reducing as much as pos-
[email protected]; [email protected]). sible risks and efforts in recuperation processes. These can be
Digital Object Identifier 10.1109/TSG.2011.2161498 solved with early warning systems (EWSs), specialized security

1949-3053/$26.00 2011 IEEE

828 IEEE TRANSACTIONS ON SMART GRID, VOL. 2, NO. 4, DECEMBER 2011

mechanisms that aid the protection of highly critical environ- of their comunications with ZigBee PRO [7], WirelessHART
ments in early stages. [8], and ISA100.11a. In this paper we will mainly focus on
Unfortunately, EWSs are not yet considered by todays con- ISA100.11a, since it is an extended version of WirelessHART
trol industry. Its security currently depends on security policies, and it improves some of its services [6].
access control mechanisms, security applications, and specific ISA100.11a allows both mesh and star topologies using: i)
detection systems, such as firewalls or intrusion detection sys- sensor nodes (working at 26 MHz, RAM 96 KB, 128 KB Flash
tems (IDSs). At this point, we may think that an EWS is appar- Memory and 80 KB ROM); ii) routers; iii) gateways (one or
ently a security mechanism similar to an IDS, since both of them several working at 533 MHz, 64 MB RAM, and 8 MB Flash
can detect anomalous situations through patterns/rules. How- memory) to establish redundant connection with the SCADA
ever, there is an important difference between them. An IDS is center; iv) backbone routers to provide connectivity to other
only able to detect existing anomalous events, whereas an EWS networks; and v) two special managers: a system manager and
is able to predict and warn about them. An EWS consists of a security manager. The system manager is in charge of allo-
an advanced monitoring component based on integrated tech- cating resources and providing communication, whereas the
niques that analyze and interpret data streams from distributed security manager affords key management services. Moreover,
sensors in remote energy substations. These techniques also in- ISA100.11a is based on the IEEE 802.15.4-2006 standard,
clude decision making procedures to avoid or reduce the prop- which specifies the physical (PHY) and media access control
agation of a possible effect originated by an anomalous event (MAC) layers for wireless personal area networks (WPANs),
[5]. To be more precise, the idea is not to precisely detect an ex- providing it with security mechanisms based on AES-128 bits,
isting failure/threat and subsequently correct it. The success of message authentication codes (MAC) and an access control
an EWS depends on the ability to anticipate an event sequence, list (ACL) to authenticate any received message. In addition,
as well as facing an anomalous situation to control the effect the standard provides security at link and transport level using
over the system or systems. message integrity codes, and unique symmetric keys of 128
Four main components constitute any EWS: i) a detection bits for solving confidential issues.
component represented by sensorial nodes; ii) a reaction com- Lastly, ISA100.11a offers a set of services for guaranteeing
ponent; iii) an information recollection component to store ev- reliability of communications, diagnosis, and alert and priority
idences; and iv) an alarm management component. The reac- management. Specially, this priority management depends on
tion component includes a process of decision making whose four subcategories (a device diagnostic, a communication diag-
determination will depend on the type of threat, the criticality nostic, a security alert, and a process alarm) and on five priority
of the affected environment, the interaction with other involved levels (journal [02], low [35], medium [68], high [911], and
elements, the associated risk and the damage-cost relationship. urgent [1215])). With respect to the dissemination from sensors
In any case, all of these components have to be active before, is managed through objects using Device Management Appli-
during and after a failure/threat appears in the system. Before cation Process (DMAP). DMAP is a class individually installed
in order to anticipate and warn about a set of suspected actions, in each network device that includes a set of objects used for
during in order to avoid that an effect starts to propagate itself configuring, supervising, and requesting parameters belonging
in the system, and after in order to control that such effect can to sensor nodes. More precisely, DMAP contemplates the alert
be propagated towards other systems. reporting management object (ARMO) class for managing, at
first level, alerts and generating reports through an AlertReport
III. BACKGROUND AND STATE OF THE ART service to an alert receiving object (ARO). ARO is a class con-
figured in a unique device in the network (the gateway in our
A. WSN, a Control, Reaction, and Warning Component case). All of these alert management objects will be discussed
As mentioned earlier, an EWS has four essential components in more detail throughout this paper given that they play an im-
associated to control/detection, reaction, recollection, and portant role in our proposal.
warning tasks. A technology capable of offering all of these
services is precisely a WSN. Its nodes (called sensor nodes) B. Reputation and Trust Management for WSNs
are able to monitor, detect, track, and alert anomalous situa- Reputation and trust are related concepts, however they have
tions thanks to its adhered sensors capable of sensing physical different meanings. Reputation is defined by the Concise Oxford
events from their surroundings, as well as its computational Dictionary as what is generally said or believed about a person
capabilities. They can also collaborate among them in order to or the character or standing of a thing while trust is defined
achieve a common goal (e.g., control of energy generators), as the firm belief in the reliability or truth or strength of an
in addition to being self-configurable, self-healing, and smart entity. From these definitions we can infer that the concept of
devices. This type of self-configurability allows sensor nodes to reputation is more objective compared to the concept of trust.
adapt by themselves in the network and react against failures, For assuring a successful collaboration, a node should be able
whereas self-healing provides them with capabilities for facing to discover which neighboring nodes are more likely of accom-
unexpected network events. plishing a certain task. If a node knows in advance how the dif-
WSN is currently considered as one of the most demanded ferent elements of the network will react in any situation, then
wireless technologies by the control industry and smart grid, it will be able to make a flawless decision. However, in a WSN
since it guarantees the same control services as a remote ter- the outcome of a certain situation cannot be clearly established
minal unit (RTU) but to a low installation and maintenance or assured. That is, we need to take uncertainty into account.
cost [6]. Even this demand has implied the recent standarization Trust and reputation systems aid dealing with the problem of
ALCARAZ et al.: AN EARLY WARNING SYSTEM BASED ON REPUTATION FOR ENERGY CONTROL SYSTEMS 829

uncertainty. In a collaborative environment such as WSN by

determining which is the best node to collaborate with becomes
very important. It is then when reputation plays a key role. By
knowing the reputation of nodes in their neighborhood and their
actual behavior, it is possible for the nodes to choose a suitable
course of action when making operational decisions (knowing
which is the best partner for starting a collaboration or in ex-
treme situations, e.g., malfunctioning nodes).
The development of trust and reputation management sys-
tems for WSN is in a very early stage of research although
growing rapidly in the past few years. Most of the existing works
are proper of ad hoc and P2P networks [9]. However, these sys-
tems do not fit all the requirements and features required by
WSN. As mentioned, this research area is becoming very active
and several surveys have been produced [10]. Still, many of the
solutions are designed with the purpose of solving very specific
problems and most of them do not deal with all the features that
a trust management system for WSN should provide although
they have been outlined in [11]. When designing a trust or rep- Fig. 1. General architecture of the model.
utation system for WSN important aspects that should be taken
into account are the sources of information and the way of com-
puting and modelling reputation or trust.
Reputation provides some interesting benefits to trust man-
agement systems (e.g., better management of aspects such as
aging). Some authors have proposed reputation-based frame-
works where nodes maintain reputation for other nodes and use
it in order to evaluate their trustworthiness. Probabilistic func-
tions are widely used as it is the case for [12].
The approach we are going to consider for the design of a
reputation system for EWS is the use of clusters. In fact, some
sensor networks group their nodes into clusters for various rea-
sons (e.g., better energy management or use of more powerful
nodes to execute complex tasks). The cluster head (CH) is in
charge of gathering and analyzing reputation values of the nodes
in its cluster and making event decisions. This is the case, for
example, of TIBFIT [13], a protocol that aims at detecting arbi-
trary node failures in an event-driven WSN where the nodes are
organized into clusters. Still, not all cluster-based systems place
the trust entity only in the CH, such as for example [14].
Fig. 2. Architecture of the cluster head.
IV. AN EARLY WARNING SYSTEM MODEL BASED ON
REPUTATION to include the reputation manager (RM in the following, see
Fig. 2). The RM will provide the gateway with information
A. The Architecture of the Model about the nodes in the EWS. The gateway contains an alarm
EWS could provide a good support for SCADA systems, as manager (AM in the following). This manager is in charge of
the actions of the latter might be influenced by the information dealing with the alerts received from the CH about nodes in the
provided by the EWS. Therefore, it is desirable to provide EWS EWS in order to determine the level of criticality of such an
with techniques that lead towards a good performance of the alarms. The AM sends to the SCADA center a SCADA alert in
SCADA systems. Our intention is to provide a reputation mech- order to be properly treated and registered (accounting), while
anism within the EWS in such a way that facilitates the deci- the most suitable operator in the affected area is also being lo-
sion making process once a warning (i.e., a SCADA alert) has cated. When the incidence has been finally treated by the se-
reached the SCADA system. lected operator, he/she has to send a report to the gateway to be
The general architecture of our model can be seen in Fig. 1. later on re-sent to the corresponding CH. Depending on the re-
Due to the energy and resource constraints of sensors in general, port, this last one will update the reputation of the sensor node
organizing sensor networks into clusters is a good approach for accordingly.
managing the existing resources. This hierarchical configura-
tion will allow us to select a cluster head (CH) in every cluster, B. The Cluster and Its Components
which will be a trustworthy node with enough resources to take Fig. 2 represents the components integrated into the CH
up essential functionalities of the EWS. In particular, it is going needed for implementing our EWS. At first, nodes, , in the
830 IEEE TRANSACTIONS ON SMART GRID, VOL. 2, NO. 4, DECEMBER 2011

cluster send their messages [ (e.g., voltage streams) and from the same node . The cache memory is ordered by the
(e.g., anomalous events)] to the CH which first operates the timestamps what makes more efficient the search as it can be
message normalization component to combine and represent achieved by tracking it using as primary identifiers the time-
different data inputs in a same generic format. The result of stamp and the . For example, when the timestamp of the
such a normalization is then sent to the pattern association message is greater than the timestamp of an entry in memory,
component in order to verify the nature of such a message. the search can be stopped in order to reduce computational over-
This component must be based on simple patterns due to high head.
constraints of the networks devices, such as for instance values The next step is to verify the message nature or sus-
(readings) out/in of a specific threshold (e.g., minimum and pect actions such as lost of messages, delay attacks or
maximum values for voltage ( ), as well as delayed replay attacks. For the analysis, the new alert will have to
messages circulating in the network and/or replay attacks. Note include, at least, the , the type of the alert and its pri-
that lost messages that come from the same node can also mean ority, as well as the type of detected event, which could be
a possible delay attack. All of these situations and any alert categorized as follows: event alert (any received from
generated by a sensor node (such as circuit break, stresses, a ), event reading out threshold (a ]),
strong fluctuations, routing, etc.) have to go through the RM event lost message, event delay attack, event replay attack,
in order to aid the whole system to verify the real state of the and event discard node.
affected area. In order to control delay attacks, for each entry in the cache
These components have been integrated into the CH because memory a new column is also included storing in it two pos-
of three main reasons. Firstly, the control in these types of sub- sible labels: event lost message/not event lost message. When
networks is generally simplified to a small number of nodes in the component receives a lost message from an , it checks
order to reduce the memory storage with information associated in cache if such a node did not send another lost message re-
to the subnetwork. Secondly, we believe that if traditional sen- cently by using the label event lost message. This label is in-
sors (working at 48 MHz, 416 KB RAM and 48128 KB flash cluded in the memory for the first time when a specific message
memory) are able to work as CHs, our CHs with higher capa- is detected as a lost message. On the contrary, when the compo-
bilities (working at 26 MHz, 96 kB RAM, 128 KB serial flash nent receives an alert or a valid (i.e., ])
memory, and 80 KB ROM) are equally feasible to process, cal- the component must also store them in the cache using the label
culate and store information. Finally, part of the processing is not event lost message for future queries. In the particular case
straightforward, since the approach has been designed for spe- where a reading is valid, it must be filtered and aggregated by
cific situations using basic behavior patterns and the calculation the data aggregation component to be sent it to the gateway later
of the reputations values is simple. Lastly, and given the dimen- on. This last action is the main task of a CH. In the following,
sion of our approach, we assume that the entire process of key we will formally describe by means of a pseudocode our model,
management and agreement between peers properly work using previously defining the functions used.
the security mechanisms offered by the ISA100.11a. as well as Obtain Normalized Message: it obtains normalized mes-
authentication and integrity services. sages from the message normalization component.
In the following we will concentrate on the functionalities Obtain Node: it obtains the .
of two of the main components: the pattern association and the Exist Memory: it tracks the cache in order to find an ex-
reputation manager. isting entry.
1) Pattern Association Component: The validation process Exist Memory LostMessage: it tracks the cache to check
of a normalized message basically consists of checking if the re- if an corresponding to a node already sent an
ceived message is really unique and recent. In order to achieve event lost message.
this, a cache memory is needed (see Fig. 2). This memory Send : it sends the normalized message to the RM in
allows the system to check if a new message received from a order to validate the state of the node and the type of de-
sensor node, was already received recently. In order to carry tected event.
out an efficient search in the cache the entries have to be ordered TReading: it verifies if the message is a .
by a specific and unique data, such as for instance the timestamp TAlert: it verifies if the message is an .
corresponding to the received messages. It would also be desir- Store Cache: it stores the messages in the cache and their
able that the data stored in the cache memory are relevant and corresponding label (i.e., either not_event_lost_message or
simple information, at least, the identification of the node event_lost_message).
, the timestamp of the message and the value associated to Send Message DataAggregation: it filters and aggregates
the message (i.e., a , or ). data streams to be sent to the gateway.
Another important task of the pattern association component Confirmation : it confirms the reception of the
is also to verify that the messages were received in a valid time message to the with an ACK (acknowledge packet).
period, i.e., in an expected time according to their timestamp. Then,
This time is calculated as the difference between the real time
of the CH and the timestamp of the message, such
that the result a configurable value ac- ;
cording to its security policies. In case where is within
;
the expected time interval, the component has to check in the
cache memory if other recent message was already received if then
ALCARAZ et al.: AN EARLY WARNING SYSTEM BASED ON REPUTATION FOR ENERGY CONTROL SYSTEMS 831

. Part of this
if (Exist_Memory(message)) then //An expected time, information (such as or and type of event) is
; // a possible obtained from the information passed by the pattern associ-
replay attack ation component. is acquired from a simple reputation
else database. Concerning the parameter the most interesting
information contained in it (e.g., alert type, alert category, and
if ( AND
) then alert priority) for reputation purposes is the alert priority (low,
medium, high, urgent, etc.). In contrast, is the reputation
parameter of a node at time , and it is calculated by a
; reputation engine inside the RM. The entries that this engine
else takes into account in order to calculate reputation values are
; initial reputation, observations gathered by neighbor nodes and
secondhand information obtained from different iterations. The
;
parameter is a timestamp representing the cycle of time that
; passes by in between the node emitted an alert (and reported
if then it to the RM) until the reputation of the node is updated (see
//storage of alert, ACK and its transfer to the RM
Section IV-D).
Initially, all the nodes in a cluster behave in a trustworthy
;
way and therefore their initial value of reputation is the highest
else possible value. After the first iteration, when nodes come into
// storage of a reading, ACK and aggregation play, the RM can update the reputation values for each of them.
The RM generates a new alert using the ARMO class defined
;
by the ISA100.11a standard in order to send to the gateway the
end , the type of occurred event, its priority and the timestamp
end . It is important to highlight that depending on the type of
end event, the RM has to determine the criticality of it. In particular,
events associated to an undesirable minimum reputation value
else
(it corresponds to an event discard node, see Section IV-D),
//The message was received in an unexpected time. a out of the threshold (an event reading out threshold) and
//This may mean: (i) a lost message or (ii) a possible delay. a compromised node in the network (an event replay attack
;
or an event delay attack) must be labeled as an urgent alert,
since these cases represent serious situations that have to be at-
if ( then
tended on time. Furthermore, as the events event replay attack,
; event delay attack, and event discard node are associated to
else compromised behaviors of sensor nodes, a replace/reconfigu-
ration procedure of affected nodes is required in the network.
;
Only two of them are really managed by the RM. They are
; event alert and event reading out threshold. A register or
end warning of anomalous situations is needed for the rest of the
end events.
Four situations may arise in our critical context: 1) false pos-
The effectiveness of this approach for detecting delay and re- itive if the analyzed event by a node is innocuous, but it is clas-
play attacks will depend on the size of the cache. In addition, sified as a threat (failure/compromised node); 2) true positive,
the control of delayed or resent messages from a compromised if the analyzed event is properly classified as a threat (failure/
node simplifies the computational cost inverted in the aggrega- compromised node); false negative, if the analyzed event is a
tion tasks. This means that the CH is able to filter and aggregate threat (failure/compromised node) but the node classified it as
data streams from different nodes, but not repeated packets from normal/innocuous; and true negative, if the analyzed event is
a unique node. correctly classified as normal/innocuous. The levels of impor-
2) Reputation Manager: In this section we will introduce tance of these cases will serve as a basis for updating reputation
how reputation can be included as an input for the decision values by the RM (see Section IV-D).
making process for a WSN, part of an EWS. Our intention is
to design a reputation manager (RM) for aiding the CH deter- C. The Gateway and Its Components
mining which nodes in its cluster are not functioning properly The next step of our model is to analyze any type of alert re-
or are acting in a compromised way in order to leave them out of ceived from CHs. The analysis must be managed by the ARO
the network for certain actions. The CH is responsible of main- class which is configured in the gateway and uses an organized
taining the RM. queue ordered by priorities [4], and for each priority is used
After the information has gone through the message nor- a buffer with a maximum size (see Fig. 3). Depending on the
malization and the pattern association components (see queue and its priorities, two tasks can concurrently be executed:
Fig. 2), the following parameters are required by the RM: i) to send the alert to the SCADA central system; ii) to activate
832 IEEE TRANSACTIONS ON SMART GRID, VOL. 2, NO. 4, DECEMBER 2011

report this fact to the gateway. The gateway will inform the
RM which then will increase the reputation of the node.
The operator determines that the type of alert priority that
the node initially reported is not as high as the node esti-
mated or it was even higher than the node estimated. Then,
this report is sent back to the RM which will decrease the
reputation of the node.
An important issue is how to decrease or increase the reputa-
tion values of a certain node, . This will depend on the alert
type priority the node reported and what the operator, who is
treating the alerts, determined about this alert.
When the reputation of a node reaches a certain threshold set
by the system as the minimum possible reputation value, the
node is discarded as useless for the cluster purposes. Let this
Fig. 3. Architecture of the ISA100.11a gateway. minimum threshold be denoted by . If for any node
in the cluster, then the node is discarded from
the operator location component when an alert is really crit- the cluster and no readings coming from it will be taken into
ical. The former task involves registering and occurred in consideration any longer.
the system, since they must be stored by the SCADA central The algorithm for updating reputation values for nodes is as
system. As the information has to be transmitted to the SCADA follows.
system through specific SCADA protocols under TCP/IP (e.g., Let us assume the number of nodes in the cluster is and
Modbus/TCP, DNP3, or IEC-104), the gateway must also act as is a sensor node in it, where . Let the alert priority re-
a special interface with capability for understanding and trans- ported by the node be denoted by and the alert priority
lating messages between different systems. For instance, IEEE reported by the operated be (see Section III-A for the
802.15.4 messages to Modbus/TCP messages and viceversa. In priority levels schema).
contrast, the latter task involves treating any type of critical in- At the initial time, is the maximum possible rep-
cidence (i.e., high/urgent ) and react against them on time. It utation to be given by the RM.
also involves location and warning to the closest field operator For at time the RM has received a report
so that he/she can approach the affected area and check the real back from the gateway stating how accurate the alert esti-
nature of the situation as soon as possible. To this end, the oper- mated by the node was. Then,
ator must previously know the and its localization, , If and then
in the area as well as the occurred event by using a handheld a false positive is produced and the RM decreases the
device. as , where is a weight that de-
As ISA100.11a defines statical networks, the can be pends on the . If then the
obtained from a simple and local database configured in the used weight should produce a reputation value that is
gateway. Note that this database must store, at least, the decreased with respect to the previous value. In case
and the . This type of design does not only allow locating that the , i.e., it is medium, the rep-
the node in the affected area in a short time, but also reducing utation value should decrease more than in the case
computational and memory overhead in CHs as well as com- where . For the other two cases where
munication overhead if was maintained by clusters. The or then the reputation value is
location of operators is outside of the scope of this paper. How- decreased more respectively.
ever, some attempts have been made in order to find the most If but then as
suitable operator in [15] based on reputation. it happened in the previous case the reputation of the
node is decreased by applying a weight . In this
case if a false negative is produced
D. Updating Reputation
and therefore the reputation of the node should decrease
After the alerts with types event alert and more by using an appropriate weight than the one used
event reading out threshold are treated by the AM, a when where a false positive is pro-
report is sent back to the RM regarding how accurate the duced.
estimation of the type of alert priority given by a node was. If is in the same interval of level priority than
This report will be used in order to update reputation. When then the reputation is increased by choosing
an alert reaches the SCADA center and an operator deals with an appthe weight should be chosen in such a way
it, he can deliver a report about the behavior of the node. The that the resulting reputation value increases.
operator is who determines the real priority of the alert. Let If the is journal, low or medium at time
the priority of the alert given by the operator, . Then, no action is taken but the RM keeps this record in a
two cases arise. temporal buffer. If at consecutive instances in time, i.e.,
The operator considers that the type of the alert priority was , the same node keeps producing
as critical as the node determined. This means the node the same type of alerts then a new message is generated
behaved in the right way and therefore, the operator will by the RM that informs about this situation and it is sent
ALCARAZ et al.: AN EARLY WARNING SYSTEM BASED ON REPUTATION FOR ENERGY CONTROL SYSTEMS 833

to ARMO. The kind of message sent will inform the anomalous situation is possibly a circuit break. All these
operator that the alert produced by node should be information is forwarded to the RM in order to validate
checked. The operator then will determine whether the the alert in an appropriate way. Then, a new alert of type
alert is a false negative or a false positive and then the event reading out threshold is generated by the RM and
RM will act as in the previous cases. set as urgent. Again, as in the previous cases, the repu-
The process continues until . Then, the tation of nodes is updated as described in Section IV-D.
node is discarded. In order to warn about this situa- 3) Cases 4 and 5. These two cases correspond to replay at-
tion, the RM has to generate another new alert of type tacks and lost of messages in the network, respectively.
event discard node with urgent priority. The pattern association component analyzes that the mes-
sages are unique and recent (Case 4) and that the time-
stamp of the message is not over (Case 5). If the
V. AN APPLICATION CASE SCENARIO: SMART GRID message is not unique then it is forwarded to the RM in
Given that an energy control system is part of a smart grid, order to generate a new alert of type event replay attack
we can apply our approach to such a scenario. The idea is to an- with urgent priority. In contrast, Case 5 is associated to
ticipate a response against a possible anomalous event in order finding an entry in the cache memory with the and a
to reduce as much as possible its negative effect over the other label event lost message. If it is not found, it must be stored
parts of the system as a whole. To this end, let us assume that in cache with label event lost message by the pattern as-
the model presented in Section IV is integrated into an electrical sociation component. Then, it is transferred to the RM in
remote substation, which is the main unit responsible for super- such a way that a new alert of type event lost message with
vising, at first level, the energy generation and its distribution to low priority is generated. As this case is not really crit-
large residential complexes. The cluster heads, , are able to ical, this type of situation does not require a reputation up-
identify five different cases. date process, but a register process in the SCADA central
1) Case 1: A receives an alert from a sensor, . For system for future auditing or maintenance procedures. In
example, a neighbor is not forwarding packages inter- case that this action is repeated several times, a field oper-
rupting thus the communication within the network. ator will have to replace/reconfigure the node.
2) Case 2: A receives a of voltage with value , from
and .
VI. IMPLEMENTATION DETAILS AND EXPECTED RESULTS
3) Case 3: A receives a with value , from a and
. At present, we are implementing our model using the de
4) Case 4: A receives the same message from a sev- facto standard operative system for sensor nodes called TinyOS,
eral times given that this node is a compromised node which provides limited support for network and protocol simu-
trying to carry out a replay attack. Note that a delay attack lations. For this reason, we are going to extend the simulations
is very similar to this particular case. to a proprietary testbed architecture with support for NesC
5) Case 5: A receives a message after from a . (component-based C-dialect [16]) and Java. This will allow
This means that the message was lost in the network and it us to provide several experiments considering diverse (either
was received in an unexpected time. extreme or nonextreme) situations.
We will next analyze the above cases and the behavior of the Although, we expect to obtain tangible results in the very near
components involved in the EWS. future, we believe that a first approximation of the results will
1) Cases 1 and 2. These cases correspond to an alert and a be as follows.
normal situation, respectively. Here, the pattern associa- 1) Fast response and protection to the rest of domains of a
tion component analyzes if the message delivered by is smart grid. A hierarchical configuration allows the system
a unique and recent message. Otherwise, the component to quickly locate an affected area and respond on time.
will have to validate if this unique message is an alert or a 2) Safety and security. Safety in the control of the cascading
valid reading. We will see the differences in between these effect. This control is based on a detection and reputation
two cases next. mechanism and on the use of a smart AM. With respect to
If the message is an alert then the pattern association com- security, the system is able to identify compromised nodes
ponent performs as described in Section IV-B1 and send by means of reputation values.
it to the RM, which realizes the operations detailed in 3) Performance. The EWS ensures performance since part of
Section IV-B2. its logic is configured in the cluster heads and the gateway,
If the message is a correct measure of voltage then the As- both of them with enough resources to carry out their tasks
sociation Pattern component has to: i) store it in the cache of detection and alarm management, respectively.
memory for recent and future analysis of events and ii) 4) Adaptability. Our model can equally work in an
send such a reading to the aggregation component in order ISA10011.a, a ZigBee PRO, and a WirelessHART
to aggregate a set of readings to the gateway. network, since all of them share certain topological,
2) Case 3. An anomalous situation happens: the association structural, and functional characteristics.
pattern component analyzes if the voltage reading is a 5) Auditing and maintenance. The system is able to ensure
unique and recent information from a by using the maintenance by identifying compromised nodes, in addi-
information stored in the cache memory. In this case as tion to offering relevant information to carry out efficient
then the system determines that the auditing procedures.
834 IEEE TRANSACTIONS ON SMART GRID, VOL. 2, NO. 4, DECEMBER 2011

VII. CONCLUSIONS AND FUTURE WORK [11] R. Roman, C. Fernandez-Gago, and J. Lopez, Featuring trust and
reputation management systems for constrained hardware devices,
We have proposed an early warning system based on WSNs in Proc. 1st Int. Conf. Auton. Comput. Commun. Syst. (Autonomics
using the ISA100.11a standard for alarm management and repu- 2007), Rome, Italy, Oct. 2007, vol. 302.
[12] F. Li, A. Srinivasan, and J. Wu, A novel CDS-based reputation mon-
tation for controlling behaviors. This model consists of different itoring system for wireless sensor networks, in Proc. 28th Int. Conf.
components that have been presented and their functionalities Distrib. Comput. Syst. Workshops (ICDCS), Beijing, China, Jun. 2008.
have also been analyzed being the main ones the pattern associ- [13] M. Krasniewski and B. Rabeler, TIBFIT: Trust index based fault tol-
erance for arbitrary data faults in sensor networks, in Proc. Int. Conf.
ation component and the reputation manager. Dependable Syst. Netw. (DSN05), Washington, DC, pp. 672681.
Although different cases have been analyzed for a smart grid [14] T. A. Zia, Reputation-based trust management in wireless sensor net-
scenario, the main idea of the proposed solution has been to pro- works, in Proc. Intell. Sensors, Sensor Netw. Inf. Process. (ISSNIP),
Dec. 2008, pp. 163166.
tect the operational control domains to indirectly protect the en- [15] C. Alcaraz, I. Agudo, C. Fernandez-Gago, R. Roman, G. Fernandez,
tire grid as a whole. Thanks to these analysis we have concluded and J. Lopez, Adaptive dispatching of incidences based on reputation
that WSNs playing as EWS are perfect candidates for offering for SCADA systems, in Proc. 6th Int. Conf. Trust, Privacy and Secu-
future solutions of EWSs. They provide the required ingredi- rity Digital Business (TrustBus), Sep. 2009, vol. 5695, Lecture Notes
on Computer Science, pp. 8694.
ents for detecting, tracking, and alerting about evidences that [16] E. Brewer, D. Culler, D. Gay, P. Levis, R. Behren, and M. Welsh,
can produce a negative effect on the performance of a domain NesC: A programming language for deeply networked systems, 2004
with an impact on the entire grid, if they are not treated properly [Online]. Available: http://nescc.sourceforge.net/, retrieved on March
2011
in advance.
We are at an initial development phase but our intention is to Cristina Alcaraz (M07) received the M.Sc.
provide a complete implementation that shows its feasibility in and Ph.D. degrees in computer science from the
University of Malaga, Spain, in 2006 and 2011,
a real and critical context. Lastly and as future work, we intend respectively.
to research how to directly include all the logic of this approach Her research activities are mainly focused on crit-
within sensor nodes. However, this will obviously depend on ical information infrastructure protection, and more
the computational capabilities and resources offered by them, precisely on secure monitoring of critical infrastruc-
tures, security of SCADA systems and smart grids, as
which are still constrained. Likewise, a security analysis of the well as the use of wireless sensor networks for pro-
approach will have to be performed in order to evaluate its in- tection of critical systems.
tegrity against existing and future faults.
Carmen Fernandez-Gago received the Ph.D.
REFERENCES degree in computer science from the University of
Liverpool, U.K., in 2004.
[1] NIST Framework and Roadmap for Smart Grid Interoperability Stan- She was with the University of Liverpool as a
dards, Release 1.0, Jan. 2010, NIST Special Publication 1108. Researcher. She is currently a Postdoctoral Research
[2] SIGiP, the Smart Grid Interoperability Panel. Introduction to NISTIR Assistant in the Security Division of the Depart-
7628 Guidelines for Smart Grid Cyber Security. Cyber Security ment of Computer Science at the University of
Working Group Sep. 2010 [Online]. Available: http://csrc.nist.gov/ Malaga, Spain. Her main research interests are the
publications/PubsNISTIRs.html, retrieved in Mar. 2011 development of trust and reputation models and its
[3] P. Peerenboom and R. Fisher, Analyzing cross-sector interdependen- applications. She has published several research
cies, in Proc. 40th Annu. Hawaii Int. Conf. Syst. Sci. (HICCS), 2007, papers in this area and is also organizing some
pp. 112119, IEEE Computer Society. international events on this topic.
[4] Wireless Systems for Industrial Automation: Process Control and Re-
lated Applications, ISA100.11a. ISA-100.11a-2009.
[5] K. Walter and E. Nash, Coupling wireless sensor networks and the Javier Lopez (M96) is a Full Professor in the Com-
sensor observation serviceBridging the interoperability gap, in puter Science Department, University of Malaga,
Proc. 12th Agile Int. Conf. Geographic Inf. Sci., 2009. Spain, and Head of the Network, Information and
[6] C. Alcaraz and J. Lopez, A security analysis for wireless sensor mesh Security (NICS) Laboratory. His activities are
networks in highly critical systems, IEEE Trans. Syst., Man, Cybern. mainly focused on network security and critical
C, Appl. Rev., vol. 40, no. 4, pp. 419428, Jul. 2010. information infrastructures protection, leading
[7] ZigBee ZigBee Technology, Sep. 2010 [Online]. Available: a number of national and international research
http://www.zigbee.org/ projects in those areas, including projects in FP5,
[8] WirelessHART WirelessHART, Sep. 2010 [Online]. Available: http:// FP6, and FP7 Framework Programmes. Prof. Lopez
WirelessHART.hartcomm.org/ is the Co-Editor-in-Chief of International Journal
[9] M. Mejia, N. Pea, J. L. Muoz, and O. Esparza, A review of trust mod- of Information Security (IJIS) and Spanish repre-
eling in ad hoc networks, Internet Res., vol. 19, pp. 88104, 2009. sentative in the IFIP Technical Committee 11 on Security and Protection in
[10] R. Roman, M. C. Fernandez-Gago, J. Lopez, and H.-H. Chen, Chapter Information Systems. He is a member of the Editorial Board of, among others,
trust and reputation systems for wireless sensor networks, in On Secu- Computers & Security, Wireless Communications and Mobile Computing,
rity and Privacy in Mobile and Wireless Networking. Leicester, U.K.: Computer Communications, Journal of Network and Computer Applications,
Troubador, 2009. and International Journal of Communication Systems.