Rapidly Restoring the Electrical Grid after Cyberattack

UIUC team delivered an online/remote environment that enabled the successful execution of the final exercise. Today, other government agencies are looking closely at the remote environment for guidance on how to respond to real-world cyberattacks when resources are spread out.

“The RADICS exercise held at PIADC grew and matured significantly over the lifetime of the program,” said Weiss. “It started out as an exercise operating in the confines of a lab, and evolved into a three-utility testbed with multiple substations and a supporting virtual environment. By the program’s conclusion, we weren’t just managing one workforce that was trying to build one crank path across the grid, but three separate ‘organizations’ that had to work together to figure out how to feed power to each other. The testbed and exercise proved beneficial not only for the program, but also for the broader community involved in grid restoration.”

Amplifying Value
Another DARPA program – the Leveraging the Analog Domain for Security (LADS) program – also was able to use the RADICS testbed as a means of program evaluation. LADS is focused on developing low-cost “cyber smoke detectors” to provide real-time situational awareness for the many devices – like power-grid controllers – that support critical infrastructure and military systems, but cannot be monitored using anti-virus or other current endpoint security technologies. Under LADS, a team (dubbed CASPER) from New-Jersey-based Perspecta Labs, developed a sensor for detecting anomalous software execution on a SCADA (supervisory control and data acquisition) device from a distance. The sensor uses machine learning to measure side-channel, radio-frequency (RF) emanations of the device and correlate those emanations with the normal software that runs on those devices.

The CASPER team participated in multiple RADICS exercises, both improving and validating its sensor’s performance in a realistic testing environment and, by the final exercise, contributing alerts to warn the RADICS teams of potentially malicious activity in power-grid controllers.

“During the first exercise that the team participated in, the LADS sensors were neither hardened to handle a harsh, real-world environment nor tuned to provide the high-confidence indicators needed to support real-time analysis,” said Ian Crone, the DARPA program manager leading LADS. “By the end of the program, however, the team was able to deploy a ruggedized and reliable sensor to meet the mission need. The RADICS exercises provided a unique environment to test both LADS and other technologies that could really improve power grid security and resilience today and in