Smart grids utilize communication technologies that make them vulnerable to cyber attacks. The power grid is a critical infrastructure that constitutes a tempting target for sophisticated and well-equipped attackers. In this paper we simulate three malware types capable of attacking smart grid networks in the ns3 simulation environment. First, an aggressive malware type, named the pandemic malware, follows a topological-scan strategy to find and infect all devices on the network in the shortest time possible, via a brute force approach. Next, the more intelligent endemic malware sacrifices speed for stealthiness and operates with a less conspicuous hit-list and permutation-scan strategy. Finally, a highly stealthy malware type called the contagion malware does not scan the network or initiate any connections but rather appends on legitimate communication flows. We define several metrics to express the infection speed, scanning efficiency, stealthiness, and complexity of malware and use those metrics to compare the three malware types. Our simulations provide details on the scanning and propagation behavior of different malware classes. Furthermore, this work allows the assessment of the detectability of different malware types.

Interconnected Industrial Control System (ICS) networks based on routable protocols are susceptible to remote attacks similar to classical Information Technology (IT) networks. However, addressing ICS security in an isolated view is dangerous since ICSs have to ensure safety measures for people, processes, and the environment. Safety and security of ICSs are often addressed separately, without considering their important interrelation. Safety measures can violate security policies (e.g., an emergency stop function accessible by anyone); likewise, a security incident can violate safety policies (e.g., by increasing reaction time). In this paper we propose a Network-based Intrusion Detection System (NIDS) with the interrelation between safety and security in mind: It detects security incidents while evaluating possible safety-related consequences of both the detected attack and possible countermeasures.We evaluate our approach with a Proof of Concept (PoC). The alerts generated by the PoC prototype serve as the basis for a risk management strategy proposed in this paper. Our approach provides a basis for safety-aware intrusion detection in smart factories and other cyber-physical systems.

The increasing power in-feed of Non-Synchronous Renewable Energy Sources (NS-RES) in the grid has raised concerns about the frequency stability. The volatile RES power output and absence of inertia in many types of NS-RES affect the balance between power consumption and production. Therefore, the dynamics of the power grid frequency become more complex. Extreme grid frequency deviations and fast variations can lead to partitioning and load shedding in the case of under-frequency. In the case of over-frequency, it can lead to overloading, voltage collapse and blackouts. The Rate of Change of Frequency (RoCoF) reflects an aspect of the stability status of the grid and therefore its analysis with regard to Non-Synchronous Instant Penetration (NSIP) is of great importance. In this work, two months of high-resolution frequency synchrophasor measurements during 18 January 2018–18 March 2018 recorded in Austria were analyzed to investigate the impact of NS-RES on the frequency. The correlation of RoCoF with the NSIP in Austria and Germany and with the frequency deviation were examined. It was observed that with a maximum NSIP share up to $74\%$ of the total power generation in these two countries, there was no critical increase of RoCoF or abnormal frequency deviation in the power grid.

Discussions of how to measure the performance of computer networks for various applications have been ongoing for over twenty years in the area of network research. The continual increase of data traffic volume has reached a point at which solving any network problem by over-provisioning is not suitable. The quest for alternatives makes it vital to have well-defined metrics for evaluating and sustaining the performance of networks.