Method for securing digital substations and system thereof

1. A method for securing digital substation, the method comprising:

configuring a switching node to connect a decoy network and a substation communication network, wherein the decoy network is a mirror of the substation communication network and is deployed to entertain one or more malicious attack requests received through an alien device;

creating a plurality of bogus medium access control (MAC) IDs, resembling similar to a plurality of critical media access control (MAC) IDs exchanged between a plurality of intelligent electronic devices (IEDs) present in the substation communication network;

providing the plurality of bogus MAC IDs to the decoy network for communicating with the alien device, wherein the plurality of bogus MAC IDs is altered periodically to provide illusion of dynamic nature of the substation communication network to the alien device;

detecting, by the switching node, the one or more malicious attack requests received from the alien device; and

in response to detection of the one or more malicious attack requests:

switching the substation network to the decoy network for displaying a set of bogus MAC IDs to the alien device depending on type of the one or more malicious attack requests; and

determining one or more attack features based on activity performed by the alien device in response to the set of bogus MAC IDs.

2. The method as claimed in claim 1 , wherein detecting the one or more malicious attack requests is performed by monitoring an unauthorized access to the substation communication network,

wherein the unauthorized access to the substation communication network is detected based on comparing internet Protocol (IP) address and MAC address of the alien device with a pre-established access control whitelist, and if the IP address and the MAC address of the alien device does not belong to the pre-established access control whitelist, determining the IP address, the MAC address as a suspicious IP address, an MAC address and detecting one or more requests generated by the suspicious IP address and MAC address as the unauthorized access to the substation communication network.

3. The method as claimed in claim 1 , wherein the decoy network comprises an agent and an informer to replicate behaviour of a station bus layer and a process bus layer present in the substation communication network respectively, wherein the station bus layer and the process bus layer are connected to a plurality of Intelligent Electronic Devices (IEDs), and

wherein the plurality of IEDs comprises at least one bay controller unit, at least one protection relay, a phase data concentrator, a wide area control unit, analog and digital measuring unit, and at least one condition monitoring device.

4. The method as claimed in claim 1 , further comprising:

activating the decoy network only in response to the one or more malicious attack requests detected from the alien device, wherein the activated decoy network is configured to interact with the alien device using the plurality of bogus MAC IDs, and

delaying response to the one or more malicious attack requests based on the determination of the one or more attack features,

wherein the one or more attack features are determined to evaluate an attack plan and/or the plurality of IEDs to be targeted by the alien device.

5. The method as claimed in claim 1 , wherein the activity performed by the alien device in response to the set of bogus MAC IDs is either manipulation or deletion of the bogus MAC IDs of the decoy network.

6. The method as claimed in claim 1 , wherein the decoy network comprises an analyst, a master, an informer, and an agent.

7. The method as claimed in claim 6 , wherein the informer mimics a station bus layer, where the plurality of IEDs is connected to a network switch and communicates with Generic Object Oriented Substation Events (GOOSE) and Manufacturing Message Specification (MMS) messages.

8. The method as claimed in claim 6 , wherein the agent mimics a process bus layer with Sampled Value (SV) messages and Generic Object Oriented Substation Events (GOOSE).

9. The method as claimed in claim 6 , wherein the master, at a station bus layer, initiates a response plan upon detection of the one or more malicious attacks and maintains alarm and event logs of the agent and the informer.

10. A switching node for securing digital substations, the node comprises: a controller configured to:

connect a decoy network and a substation communication network, wherein the decoy network is a mirror of the substation communication network and is deployed to entertain one or more malicious attack requests received through an alien device;

create a plurality of bogus medium access control (MAC) IDs, resembling similar to a plurality of critical media access control (MAC) IDs exchanged between a plurality of intelligent electronic devices (IEDs) present in the substation communication network;

provide the plurality of bogus MAC IDs to the decoy network for communicating with the alien device, wherein the plurality of bogus MAC IDs is altered periodically to provide illusion of dynamic nature of the substation communication network to the alien device;

detect the one or more malicious attack requests received from the alien device; and

in response to detection of the one or more malicious attack requests, the controller is further configured to:

switch the substation communication network to the decoy network for displaying a set of bogus MAC IDs to the alien device depending on type of the one or more attack requests; and

determine one or more attack features based on activity performed by the alien device in response to the set of bogus MAC IDs.

11. The switching node as claimed in claim 10 , wherein to detect the one or more malicious attack requests, the controller is further configured to monitor an unauthorized access to the substation communication network, and wherein the unauthorized access to the substation communication network is detected based on comparing IP address and MAC address of the alien device with a pre-established access control whitelist, and if the IP address and the MAC address of the alien device does not match with the to the pre-established access control whitelist, determining the IP address, the MAC address as a suspicious IP address, an MAC address and detecting one or more requests generated by the suspicious IP address and MAC address as the unauthorized access to the substation communication network.

12. The switching node as claimed in claim 10 , wherein the decoy network comprises an agent and an informer to replicate behaviour of a station bus layer and a process bus layer present in the substation communication network respectively, wherein the station bus layer and the process bus layer are connected to a plurality of Intelligent Electronic Devices (IEDs), and wherein the plurality of IEDs comprises at least one bay controller unit, at least one protection relay, a phase data concentrator, a wide area control unit, analog and digital measuring unit, and at least one condition monitoring device.

13. The switching node as claimed in claim 10 , wherein the controller is further configured to: activate the decoy network only in response to the one or more malicious attack requests detected from the alien device, wherein the activated decoy network is configured to interact with the alien device using the plurality of bogus MAC IDs, wherein upon determination of the one or more attack features, the controller is further configured to provide delay in responding to the one or more malicious attack requests, and wherein by determining the one or more attack features, the controller is configured to evaluate an attack plan and/or the plurality of IEDs to be targeted by the alien device.

14. The switching node as claimed in claim 10 , wherein the activity performed by the alien device in response to the set of bogus MAC IDs is either manipulation of the bogus MACIDs of the decoy network or deletion of the bogus MAC IDs of the decoy network.

15. The switching node as claimed in claim 10 , wherein the decoy network comprises an analyst, a master, an informer, and an agent.

16. The switching node as claimed in claim 15 , wherein the informer is configured to mimic a station bus layer, where the plurality of IEDs is connected to a network switch and communicates with Generic Object Oriented Substation Events (GOOSE) and Manufacturing Message Specification (MMS) messages.

17. The switching node as claimed in claim 15 , wherein the agent is configured to mimic a process bus layer with Sampled Value (SV) messages and Generic Object Oriented Substation Events (GOOSE), and

wherein the master is configured to initiate a response plan upon detection of the one or more malicious attacks and maintains alarm and event logs of the agent and the informer.

18. A system for securing digital substations, the system comprises:

a substation communication network comprising a station bus layer and a process bus layer, wherein the station bus layer and the process bus layer are connected to a plurality of Intelligent Electronic Devices (IEDs);

a decoy network comprising an agent and an informer to replicate behaviour of the station bus layer and the process bus layer present in the substation communication network respectively, wherein the decoy network is a mirror of the substation communication network and is deployed to entertain one or more malicious attack requests received through an alien device;

a switching node coupled to the substation communication network and the decoy network, wherein the switching node is configured to:

create a plurality of bogus medium access control (MAC) IDs, resembling similar to a plurality of critical media access control (MAC) IDs exchanged between a plurality of intelligent electronic devices (IEDs) present in the substation communication network;

provide the plurality of bogus MAC IDs to the decoy network for communicating with the alien device, wherein the plurality of bogus MAC IDs is altered periodically to provide illusion of dynamic nature of the substation communication network to the alien device;

detect the one or more malicious attack requests received from the alien device; and

in response to detection of the one or more malicious attack requests, the switching node is further configured to:

switch the substation communication network to the decoy network for displaying a set of bogus MAC IDs to the alien device depending on type of the one or more attack requests; and

determine one or more attack features based on activity performed by the alien device in response to the set of bogus MAC IDs.