# Evidence-Based Analysis of Cyber Attacks to Security Monitored Distributed Energy Resources
## 3 Case Study Analysis
### Monitoring and Online Diagnosis  
As we move to the advanced setting in which a monitoring system is deployed in the DER architecture, we compare the probability that the attacker manages to reach her final goal of making the system unstable, causing a physical impact on the DER operation (the shaded node in Figure 2) in the previous setting (no monitoring system), with the probability for the same event in the setting with the monitoring system implemented. We assume that in the latter setting all analytics certify that there is no adversarial activity up to instant \(t=20\); at that point the analytic update monitoring/installed software integrity check starts to signal that the attacker has modified the DER control logic. All other analytics are still giving no alarm. Figure 7 shows that, with no monitoring system in place, the chance that the attacker manages to make the system unstable, causing a physical impact on the DER behaviours, is overestimated before \(t=20\), and, even worse, after that point it is underestimated. This is a consequence of lack of information. A more detailed analysis can be found in Appendix A.2. Now suppose that an intruder aims to attack the plant controller and its internal communications following the path by first exploiting a local MITM attack and then spoofing a DER report message containing power measures (_spoof reporting message_), leading the SCADA system to a non coherent status. This can cause a correct reaction to wrong data, which will make the whole system unstable by means of physical impact on the DER behaviours. We assume that both the analytics for local MITM (service binary modifications and quick execution of a series of suspicious commands; see Figure 3) activate at \(t=15\), followed at \(t=25\) by the activation of the two analytics for the technique  
Figure 6: Probabilities of successful technique exploitation without monitoring system. spoof reporting message_ (data coherence check--device and message frequency; see Figure 3), whereas the other analytics do not signal any adversarial activity. Figure 8 shows that the model diagnostics that the attacker is taking the attack path that goes through a _localMITM_ and _spoof reporting message_, expecting with high probability a _correct reaction to wrong data_ (see Appendix A.3). All other attacks paths are very unlikely. This type of result provides information to the cyber security team, or the automatic system, checking the status of the plant controller architecture regarding the progress of an ongoing attack inside the infrastructure in terms of the more probable attack path followed by the attacker. The next experiment investigates the information given by our tool when analytics raise alerts in the expected order or in reverse order. To make this precise, consider the local MITM attack step and the spoofing of a DER reporting message. The latter can take place only after the plant controller local MITM has been successfully carried out by the attacker (see Figure 2). Then, if the attacker follows this attack path, the security analyst/system expects to see first analytics exposing a local MITM at plant controller and then later on analytics indicating a spoofing attack to DER communications. Notice that for each technique only one of two analytics specific for that technique is raising an alarm. This leaves some level of indeterminacy as to whether the techniques have actually been exploited. Figure 9 shows that out of order alerts are considered by the model less alarming, allowing for malfunctioning of the system; or are not fully credited, assuming that the attacker is following an alternative path (see Appendix A.4). While we find this response desirable, we feel that alerts that cannot be satisfactorily explained by the model should be presented as anomalies that must be investigated. This will be the object of future work.