Campus Units

Electrical and Computer Engineering

Document Type

Conference Proceeding

Publication Version

Submitted Manuscript

Publication Date



Development of a smarter electric grid necessitates addressing the associated cyber security challenges. Since the interdependence between the legacy grid infrastructure and advanced information technology is growing rapidly, there are numerous ways advanced, motivated, and persistent attackers can affect the SCADA based critical infrastructure. Hence, developing a security information and event management (SIEM) is crucial for securing the SCADA power system. This paper presents the application of Security Onion (SecOn) to develop the network security monitoring (NSM) and intrusion detection system (IDS) in the context of SCADA cyber physical security. Initially, we have applied a cyber kill-chain model to demonstrate the different stages of attacks and associated mechanisms. Later, the rulebased IDS (RIDS) is developed using Snort IDS, and tested in the cyber-physical SCADA environment. Furthermore, we have evaluated its performance in terms of accuracy and detection latency. Our experimental results reveal that the SecOn tool is efficient in monitoring and detecting attacks within an acceptable time frame with a high accuracy rate.


This proceeding is published as Singh, Vivek Kumar, Steven Perez Callupe, and Manimaran Govindarasu. "Testbed-based Evaluation of SIEM Tool for Cyber Kill Chain Model in Power Grid SCADA System." (2019). Posted with permission.

Copyright Owner

The Authors



File Format