# A Trust-Influenced Smart Grid: A Survey and a Proposal
## 11 Models and Scenario
### Familiarity-Based Definitions
#### 12. Implementation  
Prior to our model assessment, assumptions made were as follows:  
* The network communication of this substation is predictable because \(Q\) is pre-set by engineers. * The pristineness of this substation; therefore, \(\vartheta=1\) queries will be considered as malicious. * The existence of a determinate number of devices inside the network of the substation for the Modbus communication; hence, \(H_{i}\) is additionally bounded. These pairs can be categorised into two: the client group, \(H_{m}\), and the server group, \(H_{s}\). Additionally, \(H_{s}\) is restricted from sending arbitrary responses. IP-MAC pairs outside this group are considered malicious and grouped as \(H_{a}\). * Attacks that are neither Modbus nor IT-related are publicly disclosed by numerous CVE and CWE mitigation techniques; accordingly, they are considered outside of the sphere of the undertaking in this paper. * The networking port utilized for Modbus communication by a device is restricted to the port number stated in the Modbus specification document. * The attacker has penetrated the substation, achieved persistence, and has successfully evaded detection. Datasets with both malicious and normal traffic were critical in our ability to effectively test our suggested model. The EPM dataset was one of two datasets that met our requirements [108] and the other being the ATENA H2020 dataset [109]. We took the following steps:  
* The reference features (Equations (23), (36) and (44)) for the exposures in Section 11.4 were generated using the benign traffic captures of the two datasets. * Based on established documentation of the datasets and careful analysis of every network capture file (pcap file) using Wireshark, \(H_{m}\), \(H_{s}\), and \(H_{a}\) could be identified. * From \(H_{m}\) and \(H_{s}\), members that were compromised were grouped as \(H^{\prime}\). The rest of the members were the target devices, \(H_{t}\). * Per each dataset, we concentrated on communications that were concerned with \(H_{t}\) and generated sub-capture files containing their communication with the other groups. Because \(H^{\prime}\) was limited in the datasets, we relied on three types of tests to cover the attack scenarios (see Section 11.2) mentioned in this paper:  
* External Attack Test: Here, the existing condition is maintained as \(H_{m}\), \(H_{s}\), and \(H_{a}\); hence, \(H_{a}\) complies with the attack scenario \(A_{N}\) mentioned in Section 11.2.1. Evidently, the outcome is that \(Q^{\prime}\) or \(R^{\prime}\) sent from \(H_{a}\) will be flagged as expected without probing into the Modbus frame (see the first definition of Equation (43)). * Internal Attack Test: For this test, we have \(H^{\prime}_{m}\) (Equation (56)) and \(H^{\prime}_{s}\) (Equation (57)) to depict \(A_{M}\) as described in Section 11.2.2. Any \(r^{\prime}_{i}\) or \(q^{\prime}_{i}\) sent from these groups be flagged accordingly. \[H^{\prime}_{m}:H_{m}\cup H_{a}\cup H^{\prime}\] (56) \[H^{\prime}_{s}:H_{s}\cup H_{a}\cup H^{\prime}\] (57)
* Internal Attack Test with IP-MAC Blacklisting: The test and groups are the same as the internal test with the exception that any device that has \(\beta_{i}<\beta^{T}\) is added to a group of blacklisted MAC-IP pairs, \(H_{b}\); and is closed from further communication. A Java application of the trust model was built to test the generated sub-pcap file. We used pcap4j library [110] to parse the Modbus packets. We then mapped a trust scale from the literature [90] to the Multi-State Information Sharing and Analysis Center (MS-ISAC) Alert Information [111] (Figure 8). The threshold flags for the exposures were set to 0.6 and \(\beta^{T}=0\). All three tests were implemented for trust computation on the server side because there were external devices and internal devices that were used as attackers. Only the internal test was implemented for trust computation on the server side because there were only internal devices that were used for attack.