Practical defence strategy against generic self-learned GOOSE attack

Cyberattacks across the world have been increasing in frequency and efficacy. As have been highlighted in the recent Ukraine power grid cyberattacks, malicious groups are increasingly selecting infrastructure as a prime target for distributing a nation. A generic object oriented system event (GOOSE) message manipulation attack is described, highlighting the devastating impact that trivially implemented attacks could have. The same attack structure was evaluated when deployed using different vectors: human machine interface (HMI), embedded hardware (i.e supply chain attack) and when implemented by an internal saboteur on a substation. This attack was tested against multiple vendor's equipment and the results shown. Existing defence strategies are evaluated in this paper exploring and comparing their strengths and weakness. A novel defence mechanism is proposed for securing IEC 61850 GOOSE messages, Trap-bits. This strategy only requires configuration changes to Intelligent Electronic Devices (IEDs) and is compatible with existing substation equipment. Our tests were carried on commercially available substation equipment to secure against the implemented attack, the results were compared to existing methodologies and provide an excellent level of security even when compared to end to end methods.