The introduction of the cyber-physical system (CPS) into power systems has created a variety of communication requirements and functions that existing legacy systems do not support. To this end, the IEEE 1815.1 standard defines the mapping between existing distributed network protocol networks and IEC 61850 networks that reflect new requirements. However, advanced CPS cyberattacks have been reported, and in order to address cyberattacks, security research on new power systems that use network devices and heterogeneous communication is necessary. In this study, we propose an intrusion detection system for an IEEE 1815.1-based power system using CPS. We 1) analyze an IEEE 1815.1-based power system network and propose a suitable application method for an intrusion detection system, 2) suggest a bidirectional recurrent neural network-based anomaly detection system for an IEEE 1815.1-based network, and 3) demonstrate the verification of the proposed technique using various power system-specific attack data, including real power system using CPS network traffic, CPS malware behavior (CMB), false data injection (FDI), and disabling reassembly (DR) attacks. Proposed technique successfully detected five types of CMB attacks, three types of FDI and DR attacks.

With the advent of 5G technology, the enhanced Mobile Broadband technology is translating 5G-based Internet of Things (IoT) such as smart home/building into reality. With such advances, security must mitigate greater risks associated with faster and more accessible technology. The 5G-based IoT security analysis is crucial to IoT Technology, which will eventually expand extensively into massive machine-type communications and Ultra-Reliable Low Latency Communications. This paper analyses the countermeasures and verification methods of eavesdropping vulnerabilities within IoT devices that use the current 5G Non-Standalone (NSA) network system. The network hierarchical structure of 5G-based IoT was evaluated for vulnerability analysis, performed separately for 5G Access Stratum (AS), Non-Access Stratum (NAS), and Internet Protocol (IP) Multimedia Subsystem (IMS). AS keystream reuse, NAS null-ciphering, and IMS IPsec off vulnerabilities were tested on mobile carrier networks to validate it on the 5G NSA network as well. A countermeasure against each vulnerability was presented, and our Intrusion Detection System based on these countermeasures successfully detected the presented controlled attacks.

Advances in mobile communication networks from 2G to 5G have brought unprecedented traffic growth, and 5G mobile communication networks are expected to be used in a variety of industries based on innovative technologies, fast not only in terms of extremely low latency but massive access devices. Various types of services, such as enhanced mobile broadband (eMBB), massive machine type communication (mMTC), and ultra-reliable and low latency communication (uRLLC), represent an increase in the number of attacks on users’ personal information, confidential information, and privacy information. Therefore, security assessments are essential to verify and cope with these various attacks. In this research, we (1) looked at 5G mobile communication network backgrounds and problems to investigate existing vulnerabilities and (2) assessed the current situation through evaluation of 5G security threats in real-world mobile networks in service.

Through the active development of industrial internet of things (IIoT) technology, there has been a rapid increase in the number of different industrial wireless sensor networks (IWSNs). Accordingly, the security of IWSNs is also of importance, as many security problems related to IWSN protocols have been raised and various studies have been conducted to solve these problems. However, the provisioning process is the first step in introducing a new device into the IIoT network and a starting point for IIoT security. Therefore, leakage of security information in the provisioning process makes exposure of secret keys and all subsequent security measures meaningless. In addition, using the exploited secret keys, the attacker can send false command to the node or send false data to the network manager and it can cause serious damage to industrial infrastructure depending on the IWSN. Nevertheless, a security study on the provisioning process has not been actively carried out, resulting in a provisioning process without guaranteed security. Therefore, in this paper, we analyzed security issues of the provisioning process in IWSN by researching prominent IWSN standards, including ISA 100.11a, WirelessHART, and Zigbee, and also an ISA 100.11a-certified device and provisioning process-related studies. Then, we verified the security issues of the provisioning process through testing and analyzing the provisioning process using the ISA 100.11a standard-implemented devices and ISA 100.11a-certified devices. Finally, we discuss security considerations and the direction of future research on provisioning security for IWSN in the IIoT era.

KSII Transactions on Internet and Information Systems TIIS Paper Details

As the smart home ecosystem expands with the adoption of Matter, a wide variety of Internet of Things (IoT) devices are entering the market, and these devices are becoming more complex, as they support diverse functionalities. Consequently, smart home forensics often requires data extraction procedures that are specific to each device and platform, which increases the technical burden and time costs for investigators. To address these challenges, this study proposes a method that leverages Matter Multi-Admin support for multiple fabrics to enable efficient data acquisition from Matter-enabled IoT devices, regardless of the underlying smart home platform. This method configures a forensic Matter controller using chip-tool and commissions IoT devices that have already been commissioned to a smart home platform into a secondary fabric via Multi-Admin. The forensic controller then performs data extraction using standardized Matter interfaces. The proposed approach was validated on our smart home testbed by targeting a Matter smart bulb commissioned to the SmartThings platform and successfully extracting data generated by the platform, thereby demonstrating the utility of the method. The results indicate that the method enables nondestructive and efficient evidence acquisition from smart home IoT devices and can support future research and real-world investigations.