Real-time Network Intrusion Detection System with Supporting Cyber Security Regulations for Nuclear Power Plants

APR1400 is the Korean nuclear power plant (NPP) model which was first applied to Shin Kori Units 3/4 in 2006. Since then, a total of more than 6 units including Shin Hanul Units 1/2 and Shin Kori Units 5/6 have been designed and under construction. The MMIS of the APR1400 model is implemented in a computer-based digital method from the existing analog method, which has high accuracy and efficiency, but the importance of cyber security has increased in proportion. In existing nuclear power plants, all instrumentation and control (I&C) systems have been based on the hard-wiring devices, but recently, network-based instrumentation and control systems such as high-speed fieldbus have been used instead of hard-wiring. However, as the proportion of digital device-based measurement and control systems increases, cyber security, especially network security, has also emerged as a very important issue. Due to increasing national anxiety about nuclear safety caused by cyber threats from a group of nuclear hackers in December 2014, Korea nuclear regulatory agency requires nuclear licenses to establish Cyber Security Plan in accordance with the Radiological Emergency Preparedness Law and related regulatory guidelines [1-5] and to implement the plan in seven phases by 2018 [6]. The network used in the safety and non-safety control system of a nuclear power plant must satisfy a special requirement to meet high reliability, such as one-way communication and network buffering, unlike the network used in general factory automation. This means ordinary commercial network security systems are hardly used in the nuclear power plants. Hence, a specially designed cyber security system is required to meet the NPP-related regulations. One of the efficient ways to protect a network node form the unknown or suspicious network activities is to adopt a network intrusion detection system (NIDS) that analyzes the incoming network packets and warns the users upon detection of a malicious network packet or a suspicious network access form unknown network nodes. Most of the network monitoring and intrusion detection systems currently used are software-based systems that are difficult to detect high-speed network packets in real time, so that are used for the purpose of identifying root-causes or taking follow-up actions rather than defending against abnormal packets in real time. These software-based NIDS usually run on the target network nodes that should be protected or on a standalone server to protect the network subnets. While these software-based NIDS are flexible and easily reconfigurable, they still have shortcomings: First, since the incoming network packets are analyzed by software, it takes a relatively a long time to detect an abnormal packet and suspicious cyberattacks. This means that a real-time network protection is hardly implemented. Second, a server or system running a NIDS software consumes a large amount of resource that results in the packet loss, even in a low-bandwidth network environment [7]. In order to overcome the problem of the softwarebased NIDS, a hardware-based NIDS using a FPGA has been proposed [8-9]. Although such a hardware-based network monitoring device greatly improves real-time network security, additional administrative facilities are required to satisfy various regulatory conditions required for a nuclear power plant information and control systems. In this paper, we proposed a cyber security system that can be used in control networks of nuclear power plants that require high levels of reliability. The proposed system consists of DACS (Detection on Attacking Control System), DACS Management Program (DMP) to centrally manage multiple DACS, and Central Monitoring Server (CMS) to store system logs. The proposed system is designed to meet the requirements of the US Nuclear Regulatory Commission and the Korea Nuclear Cyber Security Regulations [1-5].