PaperlayerView exact revision on arXiv

Source-linked AI summary

Hardware-Assisted Detection of Firmware Attacks in Inverter-Based Cyberphysical Microgrids

Abraham Peedikayil Kuruvila, Ioannis Zografopoulos, Kanad Basu, Charalambos Konstantinou

arXiv:2009.07691v2cs.CRcs.SYeess.SY

TL;DR

Malicious firmware updates can compromise inverter controllers, while cyberattacks threaten microgrid operation. The paper uses custom-built hardware performance counters and machine-learning classifiers to detect firmware modifications, and reports high-accuracy, high-precision identification.

  • Problem

    Cyberattacks can disrupt distribution-system operation, and malicious firmware updates can compromise programmable controller devices.

    Source: §I · pp. 1–2

  • Method

    Custom-built hardware performance counters track firmware instruction sequences, and machine-learning classifiers distinguish maliciously modified from benign inverter firmware.

    Source: §I · p. 2

  • Results

    Machine-learning models trained on the custom counters identify firmware attacks with high accuracy and precision.

    Source: §VI · p. 11

  • Takeaways & Limitations

    The proof of concept demonstrates hardening a TI F2803x microcontroller with custom counters despite its lack of native hardware performance counter support.

    Source: §VI · p. 11

Abstract

from arXiv · show

The electric grid modernization effort relies on the extensive deployment of microgrid (MG) systems. MGs integrate renewable resources and energy storage systems, allowing to generate economic and zero-carbon footprint electricity, deliver sustainable energy to communities using local energy resources, and enhance grid resilience. MGs as cyberphysical systems include interconnected devices that measure, control, and actuate energy resources and loads. For optimal operation, cyberphysical MGs regulate the onsite energy generation through support functions enabled by smart inverters. Smart inverters, being consumer electronic firmware-based devices, are susceptible to increasing security threats. If inverters are maliciously controlled, they can significantly disrupt MG operation and electricity delivery as well as impact the grid stability. In this paper, we demonstrate the impact of denial-of-service (DoS) as well as controller and setpoint modification attacks on a simulated MG system. Furthermore, we employ custom-built hardware performance counters (HPCs) as design-for-security (DfS) primitives to detect malicious firmware modifications on MG inverters. The proposed HPCs measure periodically the order of various instruction types within the MG inverter's firmware code. Our experiments illustrate that the firmware modifications are successfully identified by our custom-built HPCs utilizing various machine learning-based classifiers.

I. INTRODUCTION

As distributed energy resources and smart inverters become more common, inverter firmware vulnerabilities pose risks to microgrid operation and grid infrastructure. The paper studies firmware attacks in a simulated microgrid and proposes custom hardware performance counters with machine-learning classifiers to detect firmware modifications.

I. INTRODUCTION

  • Smart inverters support microgrid generation, but firmware attacks can disrupt operation and electricity delivery.The introduction describes inverter controllers as vulnerable embedded devices and notes that firmware attacks can threaten grid infrastructure.Source: §I · pp. 1–2
  • Firmware updates and embedded-controller security gaps leave smart inverters vulnerable to malicious firmware modifications.The paper cites attacks that modify over-the-air updates and notes that secure-update solutions have not yet been deployed in industrial and commercial embedded systems.Source: §I · p. 2
  • Antivirus software can be evaded by code that changes appearance while retaining malicious functionality.The paper also notes antivirus overhead and difficulty identifying polymorphic or metamorphic malware.Source: §I · p. 2
  • The authors assess firmware modification attacks in a simulated microgrid and design custom HPCs for inverter controllers without native HPC support.They use machine-learning classifiers to detect modifications from the custom counters’ measurements.Source: §I · p. 2

II. BACKGROUND

The background introduces microgrids and the inverter setting studied in the paper. It describes how microgrids operate and why microinverters are useful, while noting security concerns in their embedded controllers.

A. Power System Preliminaries

  • A microgrid combines generation resources, energy storage, and loads, and can operate connected to the grid or autonomously.Microgrids also serve as a buffer between utilities and integrated devices.Source: A. Power System Preliminaries · p. 3
  • The study focuses on grid-tied solar sine-wave microinverters, where each panel has its own inverter and MPPT helps maximize power extraction.Microinverters can reach power-conversion efficiency of up to 96%.Source: A. Power System Preliminaries · p. 3
  • Microinverters’ COTS-based embedded controllers provide remote updates and control functions but have resource-constrained architectures and security vulnerabilities.The controllers were not initially developed with security in mind.Source: A. Power System Preliminaries · p. 3

B. Hardware Performance Counters

This background covers hardware performance counters, the machine-learning classifiers used in the study, and PCA as a feature-reduction technique. It also previews the performance metrics used to assess the classifiers.

B. Hardware Performance Counters

  • HPCs monitor low-level processor events, but the number available and simultaneously trackable varies by processor.Custom HPCs can be designed when native counters are unavailable or limited.Source: B. Hardware Performance Counters · p. 3

C. Machine Learning Classifiers

  • The paper uses PCA to reduce the number of features because only a few HPCs can be monitored simultaneously.The following background section introduces the classifiers, PCA, and performance metrics used in the experiments.Source: C. Machine Learning Classifiers · p. 3

1) ML Classifiers:

  • The study uses decision trees, neural networks, and random forests as machine-learning classifiers.A random forest combines predictions from multiple decision trees.Source: 1) ML Classifiers · pp. 3–4

2) PCA for Feature Selection:

PCA is presented as a way to reduce a feature set when only a limited number of HPCs can be monitored. The section also defines the classification outcomes used in its performance metrics.

2) PCA for Feature Selection:

  • PCA reduces feature dimensionality by using covariance and singular value decomposition to identify features associated with the largest variances.The selected principal components guide which original features are retained.Source: 2) PCA for Feature Selection · p. 4

3) ML Terminology and Metrics:

  • The metrics section distinguishes true and false positives and negatives to define classification outcomes.A true positive is malware correctly labeled malicious; a false negative is malware labeled benign.Source: 3) ML Terminology and Metrics · p. 4
  • Accuracy, precision, and recall quantify classifier performance using the defined positive and negative classifications.The section gives each metric’s formula in terms of true positives, true negatives, false positives, and false negatives.Source: 3) ML Terminology and Metrics · p. 4

III. RELATED WORK

The paper motivates firmware-level inverter protection because existing defenses can require overhead or specialized hardware, then presents a threat model and an HPC-based detection approach. It focuses on static firmware modifications to microinverter control and the MPPT process.

III. RELATED WORK

  • Existing defenses such as TPMs, secure boot, and firmware signatures can add hardware overhead and require redesign, motivating vendor-agnostic methods using embedded infrastructure,.Source: §III · p. 4
  • Prior firmware defenses include attestation, bootloader signature verification, and control-flow monitoring; the latter incurs high performance and storage overhead,,,.Source: §III · p. 4
  • The work applies HPC-based anomaly detection to inverter firmware, building on prior HPC malware and application-classification research,,,,,,,,,,.Source: §III · p. 4

A. Threat Model

  • The threat model assumes an attacker ports counterfeit firmware to a microinverter to alter setpoints or sensor measurements, through physical access or remote exploits,,,.The proposed security primitives use embedded-device functionality without requiring cryptographic signatures, TPMs, or secure boot.Source: A. Threat Model · p. 5

B. Microinverter Controller

  • The adopted PnO MPPT method uses real-time PV voltage and current measurements to generate a reference current, and the authors say their analysis can generalize to incremental conductance,,.Because MPPT controls the DC/DC boost stage interfaced with DC/AC conversion, tampering can propagate to grid-side voltage and frequency fluctuations.Source: B. Microinverter Controller · p. 5

C. Firmware Attack Designs

The paper develops firmware attacks that either disable operation or induce erroneous system output, modeling scenarios adversaries might exploit in solar microinverter code.

C. Firmware Attack Designs

1) DoS Attacks:

The section specifies DoS and MPPT-input attacks and introduces custom HPC traces to detect firmware changes. The counters capture instruction types and adjacent instruction sequences, sampled periodically from disassembled code for machine-learning detection.

1) DoS Attacks:

  • The DoS design alternates inverter locking and unlocking every 10 seconds using timer interrupts, with a second variant limited to the MPPT component.Source: 1) DoS Attacks · p. 6

2) MPPT Input Attacks:

  • MPPT-input attacks switch sensed inputs between correct measurements and either arbitrary erroneous values or continuous-sinusoid outputs.Source: 2) MPPT Input Attacks · p. 6

D. HPC-Aware Firmware Modification Detection

  • Clock-cycle profiling alone cannot distinguish benign and malicious applications that run for the same number of cycles, motivating custom HPCs for firmware-modification detection.Source: D. HPC-Aware Firmware Modification… · p. 6

1) Custom-built HPC Design and Collection:

  • The proposed HPCs count arithmetic, boolean, store, load, and branch/jump instructions, as well as sequences of instruction types.Source: 1) Custom-built HPC Design and… · p. 6
  • The 30-feature vector includes five individual instruction counts and 25 ordered adjacent-instruction counts, such as load followed by arithmetic.Source: 1) Custom-built HPC Design and… · p. 6
  • Disassembled firmware is sampled every 50 instructions; HPC counts are recorded and reset at each interval to form a dataset for training ML detectors.The authors state that the static disassembly approach can apply to other embedded systems when assembly code is obtainable, with counters adapted to available instructions.Source: 1) Custom-built HPC Design and… · pp. 6–7

V. IMPACT ANALYSIS AND DETECTION RESULTS

The evaluation uses a simulated microgrid model and examines attacks against a nominal islanded operating case. The tested scenarios include MPPT DoS, inverter DoS, and MPPT input tampering.

A. Microgrid System Model

  • The simulated microgrid combines PV with a microinverter, lithium-ion battery storage, a diesel generator, and residential and industrial loads.It connects through a 250 MVA transformer to a 13.8 kV utility point of connection; the distribution feeder is 5 kV.Source: A. Microgrid System Model · p. 7

B. Attack Impact Analysis

1) DoS Attack on the MPPT Controller:

The attacks target either MPPT availability, inverter availability, or the MPPT’s sensed inputs. Simulations show reduced generation or unstable inverter output, with potential frequency and power-quality consequences for the microgrid.

1) DoS Attack on the MPPT Controller:

  • Disabling MPPT reduces generated power and, across multiple inverters, could contribute to brownouts or load shedding when reserves cannot cover the deficit.The paper notes this attack may cause uneconomical grid operation even without catastrophic microgrid effects.Source: 1) DoS Attack on the MPPT Controller · p. 8

2) DoS Attack on the Microinverter:

  • The inverter is disabled at 15 seconds, returns at 30 seconds before a load increase at 35 seconds, and is switched off again at 45 seconds.The resulting interaction with complementary generator switching causes frequency instability and degrades power quality.Source: 2) DoS Attack on the Microinverter · p. 8, Figure 7 · p. 8

3) Input Tampering Attack on the MPPT Controller:

C. Attacks Detection Capability

The authors evaluate custom-built HPC detection on commercial TI microinverter firmware modified to represent four attack scenarios. Classifiers identify the modifications, with reported performance varying by dataset balance.

C. Attacks Detection Capability

  • The authors present the detection approach as a way to identify malicious firmware modifications with hardware-assisted HPC measurements.The paper frames prompt firmware-malware detection as relevant to preventing the previously described microgrid impacts.Source: C. Attacks Detection Capability · p. 9

1) Implementation Setup:

  • Testing used four firmware modifications on a commercial TI F2803x microinverter, with HPC counts sampled every 50 assembly instructions and data split 70:30 for training and testing.The modifications represented MPPT DoS, whole-inverter DoS, and two MPPT input-manipulation attacks; samples from attacks and base code were aggregated for DT, NN, and RF classifiers.Source: 1) Implementation Setup · p. 9

2) Detecting Firmware Modifications with ML Models:

  • With all 30 HPCs, the Random Forest classifier reports 76.4% accuracy, 95.1% precision, and 79.53% recall.The authors attribute reduced accuracy and recall across models partly to training data containing one benign version and four malicious variants.Source: 2) Detecting Firmware Modifications… · p. 9, Figure 10 · p. 9
  • On a balanced dataset, Random Forest reports 93.75% accuracy, 91.66% precision, and 95.65% recall.False-positive-to-false-negative ratios are 15.7% to 2.5% for DT, 19.6% to 7.5% for NN, and 8% to 4.5% for RF; the authors characterize the false-positive trade-off as acceptable for identifying nearly all malicious samples.Source: 2) Detecting Firmware Modifications… · pp. 9–10, Figure 11 · p. 9

3) PCA Feature Selection in ML Models:

PCA selects three instruction features for detection, while hardware synthesis evaluates classifier and counter implementation costs. The authors report that this reduced feature set supports detection with lower DfS hardware overhead.

3) PCA Feature Selection in ML Models:

  • Using three HPCs—boolean, arithmetic, and branch instructions—the NN reaches 80.33% accuracy and 100% precision, improving from 75.28% accuracy and 93.7% precision.The authors report that PCA feature selection addresses overfitting observed with 30 HPCs; three custom HPCs are sufficient for a robust defense and reduce DfS hardware overhead.Source: 3) PCA Feature Selection in ML Models · p. 10

4) Hardware Implementation:

  • The custom-built HPC logic adds a maximum 1.2% LUT area overhead when implemented in the MIPS processor.The authors state that classifier power is in the µW range and characterize the overhead as a reasonable security trade-off for inverter controllers.Source: 4) Hardware Implementation · p. 10

5) Instruction Elimination Analysis:

Instruction-elimination experiments further examine which HPC instruction types support classification, while the conclusion describes the approach and identifies future evaluation and extension work.

5) Instruction Elimination Analysis:

  • The NN trained on BLAN, which omits store instructions, reports the best one-instruction-exclusion results: 79.2% accuracy and 98.6% precision.The paper relates this result to earlier findings that boolean, arithmetic, and branch instructions are dominant.Source: 5) Instruction Elimination Analysis · pp. 10–11
  • With two instruction types excluded, the NN trained on BAN, omitting store and load, has the highest reported precision at 99.3%.The authors interpret this as further support for boolean, arithmetic, and branch HPCs.Source: 5) Instruction Elimination Analysis · p. 11

VI. CONCLUSION

  • The paper demonstrates firmware-modification attack impacts on a solar microinverter operating in a microgrid.Source: §VI · p. 11
  • Custom-built HPCs periodically sample firmware instructions and are used as design-for-security primitives to detect firmware attacks.The proof-of-concept applies these counters to the TI F2803x microcontroller, which lacks native HPC support.Source: §VI · p. 11
  • The authors report that machine-learning models trained on the HPCs identify firmware attacks with high accuracy and precision.Source: §VI · p. 11
  • Future work includes extending HPCs to other firmware-controlled grid assets, formalizing detection for additional attacks, and evaluating with hardware-in-the-loop experiments.The authors also plan to demonstrate attack impacts in real-time operation.Source: §VI · p. 11
Loading 2009.07691v2…