Provable Anonymization of Grid Data for Cyberattack Detection
Data is frequently not shared by organizations because that data is considered by the organization to be in some way sensitive. For example, there may be laws or regulations prohibiting sharing due to personal privacy or national security issues, or the organization owning the data may also consider that data to be a proprietary trade secret. In any case, that data cannot or will not be released in raw form, and so alternative approaches are needed if that data is to be shared at all.
Today, data is often not shared at all, or if it is shared, it is done so in ways that require people processing or analyzing that data to access the data in highly secured, non-networked environments set up to prevent any data from being exfiltrated either physically from a building or certainly from a network. This is the reason why much research is hindered. Sometimes data is shared through processes of “anonymization” in which data is typically either masked or made more general. Unfortunately, these techniques have repeatedly been shown to fail, typically by merging external information containing identifiable information with quasi-identifiers contained in the dataset in order to identify “anonymized” records in the dataset.
This project aims to develop techniques for enabling data analysis for the purposes of detecting and/or investigating cyberattacks against energy delivery systems while also preserving aspects of key confidentiality elements within the underlying raw data being analyzed. Specifically, this project proposes to examine the application of privacy-preserving techniques to OT and grid-security-relevant IT data provided by the California Energy Commission (CEC), Kevala, and Portland General Electric, in order to protect privacy as much as possible, thereby minimizing the amount of data for which “traditional” (and vulnerable) anonymization techniques need to be applied. The result will be a solution for anonymization of data collected from OT and IT networks pertaining to energy grid cyberattack detection that has been tested for its ability to retain privacy properties and still enable attack detection.
This project is supported by the U.S. Department of Energy’s Cybersecurity for Energy Delivery Systems (CEDS) program.
DOE Press Release: “ Department of Energy Announces Awardees of $30 Million Research Call to Enhance Cybersecurity for Energy Delivery Systems,” August 27, 2019.
Sean Peisert (PI; LBNL)
Nikhil Ravi (Cornell Tech)
Publications resulting from this project: