# Evidence-Based Analysis of Cyber Attacks to Security Monitored Distributed Energy Resources
## 2 Methodology
### Security Analytics  
In order to focus on attack monitoring and detection, we integrated in our model analytics from the Cyber Analytics Repository (CAR) [41]. A security analytic describes events whose observation is significant from a security prospective. Each analytic is connected to the techniques that the analytic helps to expose. The ICS ATT&CK matrix has not yet been complemented with analytics. Thus, we use analytics proposed by MITRE for exposing the techniques of the ICS ATT&CK matrix wherever this is appropriate, whereas, for all techniques peculiar to the ICS world or to the power domain, we propose specific ones.  
The analytics can be implemented by sensors residing on different nodes of the infrastructure. Figure 3 highlights the architectural levels that are monitored, i.e., plant controller and field devices. This will be clearer as we proceed in the presentation. Some analytics refer to incongruuities in message exchanges--for example, checking the coherence with past measures and commands, or device characteristics. Others are specific for system level anomalies regarding command and application execution or location.  
To expose the deployment of _modify control logic_, one must implement, for instance, software integrity checks and update monitoring (analytic update monitoring/installed software  
Figure 2: The attack graph.  
integrity check). This analytic reports on the integrity of field devices. The arrow from _modify control logic_ to the analytics in Figure 3 indicates that the technique exploitation by an attacker may trigger the analytics.  
Local MITM can be viewed as a specialisation of IT techniques, so in this case we borrowed analytics from the IT CAR; namely, quick execution of a series of suspicious commands and service binary modifications. Both analytics report on SCADA integrity (see Figure 3): for the first one, a sensor looks for a series of specific commands executed in a quick sequence; for the latter, integrity of the SCADA binary code is verified. See in Figure 3, the correspondence.  
In the case of techniques that modify or spoof command messages to disrupt normal operation, we assume that syntactic message level checks are in place and we additionally work at application level (a detection system is more effective if it has deeper knowledge of the system it defends). At a syntactical level, the check could be performed considering the information flow profile of control protocols; e.g., IEC 61850 [42] or IEC 60870-5-104 [43] message frequency. This suggests an analytic to expose the usage of the technique _spoof report message_: under the hypothesis that measure reports are sent with periodical cadence, a spoofed message will break this periodicity and therefore raise an alert. This is modelled by the analytic message frequency. This analytic monitors correctness of communications, as depicted in Figure 3. At a semantic level, the application monitoring system would raise an alert if, e.g., a command was not consistent with the technical characteristics of the device, data coherence check-device. The latter can be implemented also to expose spoofed or modified reported data, by checking that the reports are consistent with the device characteristics. See in Figure 3 the correspondence of this analytic with techniques.