How to sniff the G3 and Primedata and detect the interfere
attackAbstract• This topic will talk about how to get the PLC data stream in a PLC
communication system which would use G3 or Prime standard, andwill also talk about how to detect attacking in the net.
• We will focus on how to identify which kind of standard the systemusing and how to sniff the PLC data in physical level.

What is PLC?
• PLC is a kind of communication technology which used the power line
as the communication medium. This technology ensure power line do
the data transfer while supply power.

PLC classification• Low bandwidth PLC, High bandwidth PLC
Classification

Modulation Datarate(bps)Benefit

Application

Low bandwidth

FSK,OFDM

5K~100K

Long communication
distance, crosstransformer

Power‐meter AMR, Municipal
facilities, Smart gridHigh bandwidth

DMT

Up to 100M

High‐speed data access Internet accessFocus On: Low bandwidth PLC• Low bandwidth PLC Physical Layer sniff, Physical attack

G3 and Prime Features
Parameter

PRIME

G3

Base band clock
Simbol leng
Preamble leng
Factors
ModulationBand

250kHz2240 μs
2048 μs
84（Header）,96（Payload）
DBPSK / DQPSK
42K~89 kHz

400kHz735 μs6792 μs
36
DBPSK / DQPSK
36K~91KHz

How to Identify G3 or Prime• Power Spectrum Estimation• With power spectrum estimation, we can get the energy spectrum
density distribution. The energy spectrum distribution is related tothe signal band, which is different in PRIME and G3.

How to Identify G3 or Prime• Let us see the standard OFDM spectrum distribution

How to Identify G3 or Prime• Step1: Get the Power Spectrum of Communication signal• Step2: Calculate the standard OFDM Power Spectrum• Step3: Match the signal power spectrum and standard powerspectrum, identify the carrier band.

•How to Identify G3 or Prime‐Get Signal PowerSpectrum• Communication signal is x(t), after sample, get xa(t).
• According Wiener‐Khintchine theorem, the power spectrum
density of stationary random process can be obtained by theFourier transform of the autocorrelation of the discrete sequence.
•Px(e )   rx(k )ejk   jk

How to Identify G3 or Prime‐Get Signal PowerSpectrum• We define the process is Mean‐Ergodic to simulate thecommunication process. SoN1*
•r x ( k )  limx(nk)x(n )N  2N 1 k N• To cut the signal with N point Rectangular Window, the biased
estimation of r(x) is
rx(k ) 1 N 1*x(nk)x(n )N n 0How to Identify G3 or Prime‐Get Signal
Power Spectrum
The Periodogram isjPx(e ) N 1

 rx(k )e jkk  N  1• And

E{Px(ej )} 1Px(ej )* WB(ej(0 ))2WB(ej )is the DTFT of Bartlett Window, and1  sin( N  / 2 )W B (e j ) N  sin(  / 2) 2

How to Identify G3 or Prime‐Get Signal
Power Spectrum
The Resolution of Periodogram isRes[Pper(ej )]    0.89

2NHow to Identify G3 or Prime‐Get Signal
Power Spectrum• The carrier band for PRIME is 42KHz~89KHz, and the carrierband for G3 is 36KHz ~ 91KHz. Considering some margin
above the Nyquist frequency, set 400KHz as the samplefrequency(fs).
• Define the resolution of frequency is 0.5kHz,

ffs

How to Identify G3 or Prime‐Get Signal
Power Spectrum
Get N>712,
For FFT, define N= 1024, f=0.35KHz

How to Identify G3 or Prime‐Get Signal
Power Spectrum‐How to increase SNR
System Noise‐ Common Frequency Noise‐ Switch Noise‐ White NoiseHow to Identify G3 or Prime‐Get Signal
Power Spectrum‐How to increase SNRSignal Power Spectrum would be communication signal
power spectrum plus noise power spectrum.

How to Identify G3 or Prime‐Get Signal PowerSpectrum‐How to increase SNR‐ Pass Band‐Pass‐Filter to remove out‐band noise‐ Calculate base noise power spectrum‐ Offset the noise power spectrum in signal powerspectrum

How to Identify G3 or Prime‐Calculate
OFDM Power Spectrum• The Power Spectrum of OFDM is equal to the sum of sub‐factor carrierband power spectrum.

How to Identify G3 or Prime‐Calculate
OFDM Power Spectrum• What’s is OFDM
• OFDM(Orthogonal frequency‐division multiplexing)• ‐ A method of encoding digital data on multiple carrier frequencies.
• ‐ sub‐carrier is modulated with a conventional modulation scheme ata low symbol rate, maintaining total data rates similar toconventional single‐carrier modulation schemes in the samebandwidth.

How to Identify G3 or Prime‐Prime‐Calculate OFDM Power Spectrum• The Power Spectrum of OFDM is equal to the sum of sub‐factor carrierband power spectrum.
S BPSK ( f ) S QPSK ( f ) T b sin c (( f  f ck )T b )  sin c (( f  f ck )T b ) / 4
ckN 122

0N 1

 T b [sin( 2  ( f  f ck )T b ) /( 2  ( f  f c )T b )]ck
0

• Tb for PRIME is 2240uS, for G3 is 735uS2

 [sin( 2  ( f  f ck )T b ) /( 2  ( f  f c )T b )] 2 / 4

How to Identify G3 or Prime‐Identify G3 orPRIME• Crosscorrelation‐ Measure the degree to which the two signals aresimilar.
N2xy(0)   x(n)y(n)/ rx(0) * ry(0)n N 1

How to Identify G3 or Prime‐Identify G3 orPRIMEFrequency sample,

fs = 400KHz, 0=zfsFocus on band of 32KHz~95KHz for some margin,
Calculate the xy(0), xy(0) >0.9 is acceptable correlation.

How to sniff Physical layer data‐ OFDM
Modulation and Demodulation structure

How to sniff Physical layer data‐ OFDM
Demodulation• The modulation signal isN 1s ( t )   d ( n ) e j 2fntn0• after demodulation, the signal isNT N 1N 1 NTs11sj 2 fnt  j 2 fmtd (m) d (n)eedt d (n) e00NTsNTsn0n0j 2nmtNTs

dt  d (m)How to sniff Physical layer data‐ OFDMDemodulation
N 1s (t )   d (n)ej 2 ( f 0 n)tNTsn0N 1

j 2ntNTs

 [  d ( n )e] e j 2 f 0 tn 0sl ( t )s l (t )is the base band, sample to the base band signal get s ( k )lN 1sl ( k )   d ( n ) en0

j 2ntNTs

N 1t  kTs

  d (n)en 0j 2nkN,0  n, k  N  1

How to sniff Physical layer data‐ OFDM
Demodulationd (n )

is the FDT of s (k ) ,Need to calculate with FFT.
lHow to detect the interfere attack
Interfere Attack will takes the communication channel and block the node
to do the service.
OFDM Interfere attack will be in several slave carrier frequency or thewide band.
The attacker will generate a strong enough interference signal which willcause to receiver cannot modulate the digital signal correctly.
With checking the signal Power Spectrum, it would detect the attacksignal.

Thanks!