# Evidence-Based Analysis of Cyber Attacks to Security Monitored Distributed Energy Resources
## 1 Introduction  
In recent years, energy infrastructure has been evolving from a traditional architecture where the communications are intra-operator and private, to a new landscape that requires advanced functionalities such as distributed energy resource (DER) control, demand response from flexible loads, and electric vehicle charging management. The evolution is supported by new information and communication technology (ICT) solutions involving end devices, algorithms, and communication networks through heterogeneous and possibly third party infrastructures and services. In the same network, new components have to interact with legacy ones with no or limited cyber security measures. In this setting, the exploitable attack surface widens and the cyber security management becomes a core process. In European member states, essential service operators (including energy operators) are required to implement the European Network and Information Security (NIS) Directive 2016/1148 [1] whose compliance implies developing methodologies to prevent cyber attack processes to succeed by detecting ongoing attack steps and implementing fast response and defence measures. It is of paramount importance that energy organisations and their employees, within the corporate offices, information technology (IT) and operational technology (OT) departments, and field engineers, are aware of possible threats that may target their cyber-power infrastructures and are prepared to cope with the expected evolution of cyber attacks. This paper presents a methodology based on artificial intelligence techniques, in particular, dynamic Bayesian networks (DBNs) [2], modelling the cause-effect connections between possible attack techniques deployed by adversaries and observable analytics. Factually relating observable events, such as system and application logs, to unknown adversarial activity, enable anticipating attack behaviours for a prompt and effective defence. A thorough understanding of such relations is necessary to design a cost-effective infrastructure for evidence collection that can help facing adversarial threats. Detection of adversarial activity is a tricky task due to the multifaceted actions that an attacker can take and in relation to complexities of cyber-physical control systems and their maintenance. A simplistic example is the detection of a malicious alteration of the control software: it must be carefully distinguished from a regular software upgrade in terms of generated alerts. Such issues bring forward the necessity of identifying correctly which aspects must be monitored (and how) because they are more revealing than others, and how to combine the information gathered from different sensors so as to draw a meaningful picture of what is going on in the system. In this spirit, our work aims first of all at exploiting the existing knowledge on attacks in a model capable of rendering in a realistic fashion the possible attack scenarios, in order to understand what the relevant evidence is that must be collected from DERs and the central SCADA controller. The next step will then be validation in a test laboratory of the modelling results; for this step we implement a framework for attack emulation and detection, integrated in a grid telecontrol setup connecting DER control networks. We plan to learn from this second phase whether our choices are adequate and thus get a feedback to improve the model. When our design choices for the monitoring system will be satisfactory and stable, then our proof-of concept will be ready for the validation on field data, prior to its deployment in a real operational environment.