Real-Time Detection and Identification of ARP Spoofing Attacks in Microgrids

Abstract

The integration of smart devices and advanced communication infrastructure has turned power systems into cyber-physical systems (CPS), introducing cyber vulnerabilities. One such vulnerability arises from the use of the address resolution protocol (ARP), which is commonly employed in power systems’ information technology (IT) infrastructure to assign internet protocol (IP) addresses to devices such as relays, controllers, and meters. Due to the lack of authentication in ARP, attackers can exploit it to infiltrate substation automation systems (SAS). To detect and locate ARP spoofing attacks, a novel network intrusion detection system (NIDS) was developed using Snort3, TShark, and Python scripts to monitor ARP broadcast messages. This detection method was tested on a dedicated, real-time multi-agent CPS testbed, where a microgrid is simulated as the physical layer using a real-time digital simulator (RTDS), while the cyber layer consists of a multi-agent control implemented in a graphical network simulator (GNS3) together with Raspberry Pi devices. The real-time operator’s view is developed in Grafana visualization, mimicking the real-world microgrid operation. Two common practical ARP attacks, known as man-in-the-middle (MITM) and false data injection (FDI) attacks, were conducted to evaluate the performance of the proposed NIDS method. Both MITM and FDI attacks were implemented using IT network testing tools, such as Ettercap and the Scapy library in Python. The results have shown that the proposed NIDS system can detect, localize, and publish the IP address of the attacker in both MITM and FDI attack scenarios. In addition, the impact analysis results indicated that for an identical malicious payload, the FDI attack is more severe when compared to MITM due to the intermittent nature of false data injection.