@article{article,

title = {SPEAR SIEM: A Security Information and Event Management system for the Smart Grid},

author = {Panagiotis Radoglou Grammatikis and Panagiotis Sarigiannidis and Eider Iturbe and Erkuden Rios and Saturnino Martinez and Antonios Sarigiannidis and Georgios Efstathopoulos and Yannis Spyridis and Achilleas Sesis and Nikolaos Vakakis and Dimitrios Tzovaras and Emmanouil Kafetzakis and Ioannis Giannoulakis and Michalis Tzifas and Alkiviadis Giannakoulias and Michail Angelopoulos and Francisco Ramos},

url = {https://www.researchgate.net/publication/350287201_SPEAR_SIEM_A_Security_Information_and_Event_Management_system_for_the_Smart_Grid},

doi = {10.1016/j.comnet.2021.108008},

year  = {2021},

date = {2021-01-01},

journal = {Computer Networks},

abstract = {The technological leap of smart technologies has brought the conventional electrical grid in a new digital era called Smart Grid (SG), providing multiple benefits, such as two-way communication, pervasive control and self-healing. However, this new reality generates significant cybersecurity risks due to the heterogeneous and insecure nature of SG. In particular, SG relies on legacy communication protocols that have not been implemented having cybersecurity in mind. Moreover, the advent of the Internet of Things (IoT) creates severe cybersecurity challenges. The Security Information and Event Management (SIEM) systems constitute an emerging technology in the cybersecurity area, having the capability to detect, normalise and correlate a vast amount of security events. They can orchestrate the entire security of a smart ecosystem, such as SG. Nevertheless, the current SIEM systems do not take into account the unique SG peculiarities and characteristics like the legacy communication protocols. In this paper, we present the Secure and PrivatE smArt gRid (SPEAR) SIEM, which focuses on SG. The main contribution of our work is the design and implementation of a SIEM system capable of detecting, normalising and correlating cyberattacks and anomalies against a plethora of SG application-layer protocols. It is noteworthy that the detection performance of the SPEAR SIEM is demonstrated with real data originating from four real SG use case (a) hydropower plant, (b) substation, (c) power plant and (d) smart home.},

keywords = {Anomaly Detection, Auto-encoder, Cybersecurity, Deep Learning, Generative Adversarial Network, Machine Learning, Modbus, Smart Grid},

pubstate = {published},

tppubtype = {article}

}

@article{ARGYROPOULOS2021307,

title = {Addressing Cybersecurity in the Next Generation Mobility Ecosystem with CARAMEL},

author = {Nikolaos Argyropoulos and Pouria Sayyad Khodashenas and Orestis Mavropoulos and Eirini Karapistoli and Anastasios Lytos and Paris Alexandros Karypidis and Klaus-Peter Hofmann},

url = {https://www.sciencedirect.com/science/article/pii/S2352146521000685},

doi = {https://doi.org/10.1016/j.trpro.2021.01.036},

issn = {2352-1465},

year  = {2021},

date = {2021-01-01},

journal = {Transportation Research Procedia},

volume = {52},

pages = {307-314},

abstract = {The proliferation of next generation mobility, promotes the use of autonomous cars, connected vehicles and electromobility. It creates novel attack surfaces for high impact cyberattacks affecting the society. Addressing the cybersecurity challenges introduced by modern vehicles requires a proactive and multi-faceted approach combining techniques originating from various domains of ICT. Emerging technologies such as 5G, LiDAR, novel in-vehicle and roadside sensors and smart charging, used in modern cars, introduce new challenges and potential security gaps in the next generation mobility ecosystem. Thus, it is critical that the domain’s cybersecurity must be approached in a structured manner from a multi-domain and multi-technology perspective. The CARAMEL H2020 project aims to address the cybersecurity challenges on the pillars upon which the next generation mobility is constructed (i.e., autonomous mobility, connected mobility, electromobility). To achieve that, advanced Artificial Intelligence (AI) and Machine Learning (ML) techniques will be utilized for the identification of anomalies and the classification of incoming signals indicating a cyber-attack or a cybersecurity risk. Apart from risk detection, methods for the mitigation of the identified risks will also be continuously incorporated to the CARAMEL solution. The final goal of CARAMEL is to create an anti-hacking platform for the European automotive cybersecurity and to demonstrate its value through extensive attack and penetration scenarios. In this paper we will expand on the unique cybersecurity-relevant characteristics of the pillars upon which the CARAMEL solution is built. Next, a number of use cases emerging from such analysis will be extracted in order to form the basis upon which the CARAMEL platform will be evaluated. Finally, we will conclude with an overview of the platform’s architectural composition.},

note = {23rd EURO Working Group on Transportation Meeting, EWGT 2020, 16-18 September 2020, Paphos, Cyprus},

keywords = {Artificial intelligence, Automated mobility, Connected mobility, Cybersecurity},

pubstate = {published},

tppubtype = {article}

}

@article{radoglou2021modeling,

title = {Modeling, detecting, and mitigating threats against industrial healthcare systems: a combined software defined networking and reinforcement learning approach},

author = {Panagiotis Radoglou-Grammatikis and Konstantinos Rompolos and Panagiotis Sarigiannidis and Vasileios Argyriou and Thomas Lagkas and Antonios Sarigiannidis and Sotirios Goudos and Shaohua Wan},

url = {https://ieeexplore.ieee.org/abstract/document/9470933},

doi = {10.1109/TII.2021.3093905},

year  = {2021},

date = {2021-01-01},

urldate = {2021-01-01},

journal = {IEEE Transactions on Industrial Informatics},

volume = {18},

number = {3},

pages = {2041--2052},

publisher = {IEEE},

abstract = {The rise of the Internet of Medical Things introduces the healthcare ecosystem in a new digital era with multiple benefits, such as remote medical assistance, real-time monitoring, and pervasive control. However, despite the valuable healthcare services, this progression raises significant cybersecurity and privacy concerns. In this article, we focus our attention on the IEC 60 870-5-104 protocol, which is widely adopted in industrial healthcare systems. First, we investigate and assess the severity of the IEC 60 870-5-104 cyberattacks by providing a quantitative threat model, which relies on Attack Defence Trees and Common Vulnerability Scoring System v3.1. Next, we introduce an intrusion detection and prevention system (IDPS), which is capable of discriminating and mitigating automatically the IEC 60 870-5-104 cyberattacks. The proposed IDPS takes full advantage of the machine learning (ML) and software defined networking (SDN) technologies. ML is used to detect the IEC 60 870-5-104 cyberattacks, utilizing 1) Transmission Control Protocol/Internet Protocol network flow statistics and 2) IEC 60 870-5-104 payload flow statistics. On the other side, the automated mitigation is transformed into a multiarmed bandit problem, which is solved through a reinforcement learning method called Thomson sampling and SDN. The evaluation analysis demonstrates the efficiency of the proposed IDPS in terms of intrusion detection accuracy and automated mitigation performance. The detection accuracy and the F1 score of the proposed IDPS reach 0.831 and 0.8258, respectively, while the mitigation accuracy is calculated at 0.923.},

keywords = {Cybersecurity, IEC-60870- 5-104, Internet of Things (IoT), Intrusion detection, Machine Learning, Software Defined Networks},

pubstate = {published},

tppubtype = {article}

}

@article{9066892,

title = {A Survey on SCADA Systems: Secure Protocols, Incidents, Threats and Tactics},

author = {Dimitrios Pliatsios and Panagiotis Sarigiannidis and Thomas Lagkas and Antonios G Sarigiannidis},

url = {https://ieeexplore.ieee.org/abstract/document/9066892},

doi = {10.1109/COMST.2020.2987688},

year  = {2020},

date = {2020-01-01},

journal = {IEEE Communications Surveys Tutorials},

volume = {22},

number = {3},

pages = {1942-1976},

abstract = {Supervisory Control and Data Acquisition (SCADA) systems are the underlying monitoring and control components of critical infrastructures, such as power, telecommunication, transportation, pipelines, chemicals and manufacturing plants. Legacy SCADA systems operated on isolated networks, that made them less exposed to Internet threats. However, the increasing connection of SCADA systems to the Internet, as well as corporate networks, introduces severe security issues. Security considerations for SCADA systems are gaining higher attention, as the number of security incidents against these critical infrastructures is increasing. In this survey, we provide an overview of the general SCADA architecture, along with a detailed description of the SCADA communication protocols. Additionally, we discuss certain high-impact security incidents, objectives, and threats. Furthermore, we carry out an extensive review of the security proposals and tactics that aim to secure SCADA systems. We also discuss the state of SCADA system security. Finally, we present the current research trends and future advancements of SCADA security.},

keywords = {Cybersecurity, Protocols, SCADA, Security, Smart Grid, Trends},

pubstate = {published},

tppubtype = {article}

}