A Cyber Kill Chain Model for Distributed Energy Resources (DER) Aggregation Systems

Increasing penetration of networked distributed energy resources (DER) in electric power systems managed by multiparty are expanding the power system attack surface. An outstanding threat is sophisticated attackers who possess extensive knowledge of the systems and keep trying to attack DER systems, which have not been well mitigated by existing defense strategies. This paper explores a cyber kill chain model for a DER aggregation system based on a latest METRE's cyber kill chain model to model possible attack phases and requirement of defensive actions per each attack step, eventually toward detecting and neutralizing the intent of the sophisticated attackers.