The Smart Grid is the modern system of wires, meters, and transformers that work together to power our homes and businesses. We connect ourselves to the Smart Grid when we plug in our devices and click on the light switch. The electricity grid is older than you might have thought—it was developed in the 1890s and evolved along with our ever-changing technology [5] . Today, the modern Smart Grid contains over nine thousand electricity generating units, has over one million megawatts of generating capacity, and is connected to more than three hundred thousand transmission lines. Smart Grid is divided into three main networks: the operation network, the business network, and the customer network. Each of these three networks has individual set of communication subnetworks serving different functions. The first, operation network is used for maintaining the Grid functionality by the power companies. The second one, the business network is used by the participants in the electricity market to effectively regulate the market and to provide electricity services to the customers at large. The last part which is the customer network is used by individual customer for management of their home energy and to enhance the electricity usage [6] . Due to the division of the Smart Grid networks in terms of communication, Smart Grid is divided into three areas as shown in Figure 1 . such as WAN, HAN, and NAN. WAN (Wide Area Network) provides communication links or interface between the NANs and the utility systems in order to transfer information. NAN (Neighborhood Area Network) in its case connects multiple HANs to the local access points. HAN (Home Area Network), this communication is for end user home or business communications [7] .

Figure 2 below depicts generic Smart Grid Network Architecture components or modules with different reference points.

As shown, typical Smart Grid network consists of following components.

Grid domain: Operations include bulk generation, distribution, and transmission Smart meters Consumer domain: HAN (Home Area Network) consists of smart appliances and more. Communication network: This connects smart meters with consumers and electricity company for energy monitoring and control operations, include various wireless technologies such as Zigbee, wifi, HomePlug, cellular, GSM, GPRS, 3G, 4G-LTE, etc. Third-party service providers: system vendors, operators, web companies etc.

Smart Grid security has attracted a lot of attentions from both academic and industry communities. Some of the reviews and comments are thereby highlighted as part of this research paper. Asri, S., Pranggono, B. Impact of Distributed Denial of Service Attack on Advanced Metering Infrastructure. Wireless Personal Communications 83(3), 2211-2223 (2015) [3] . The results showed that the entire grid could be compromised with a large-enough DDoS attack but Only after the server had been taken offline was an impact observed. Fang et al. The contributions of cloud technologies to Smart Grid. Renewable and Sustainable Energy Reviews, Vol. 59, pp. 1326-1331, June (2016) [9] . The results showed the review of application of different areas of cloud computing technology in Smart Grid and finally, cloud security is briefly investigated. No precise framework has been proposed to enhance the security of the Smart Grid and issues were surveyed generally. Abdul Rahman et al. Smart Grid security challenges: Classification by sources of threat. Journal of Electrical Systems and Information Technology, Vol. 5, No. 3, pp. 468-483, Dec. (2018) [10] . The authors examined security challenges of Smart Grid and they classified and analyzed identified challenges based on threat sources carefully. Meanwhile, their proposed framework is very general and vague and needs to be focused on domains of Smart Grid. In fact, the authors did not provide a specific solution and technique. Shrestha. M et al. A Methodology for Security Classification applied to Smart Grid Infrastructures. International Journal of Critical Infrastructure Protection, 28 (2020) [11] . The authors proposed a methodology called Smart Grid Security Classification (SGSC) developed for complex systems such as the Smart Grid. They indeed covered risk analysis methods, security criteria and protection mechanism in their methodology. Their methodology does not support automatic computation of scores and multi-metrics approach. K. Demir et al. Securing the cloud-assisted Smart Grid. International Journal of Critical Infrastructure Protection, pp. 100-111, Dec. (2018) [12] . The authors proposed cloud computing technology to improve the security of the Smart Grid. They specifically concentrated on distributed denial of service attack and counteracting it. There is no comprehensive approach to enhance Smart Grid security using cloud computing technology in this paper and it focuses only on countering a specific attack. Souris, K.I et al. Cyber Attack Impact on Critical Smart Grid Infrastructures. ISGT pp. 1-5. IEEE (2014) [5] . The authors considered four different types of AMI DoS setups. The results showed that DoS attack against the server caused a drop in the number of TCP packets delivered to smart meters, leading to some service degradation. Also, the DDoS attack on the server reportedly diminished connections with almost 90% of the smart meters. Yilmaz, E.N et al. Cyber Security in Industrial Control Systems: Analysis of DoS Attacks Against PLCs and the Insider Effect. In: 2018 6th International Istanbul Smart Grids and Cities Congress and Fair (ICSG). pp. 81-85. IEEE (2018) [13] . The authors explored the possibility of DoS attacks against PLCs, suggesting that a PLC can be targeted both from within and outside of its own IP network, as long as its IP address is known. The results showed that the network was quickly disrupted even with a small number of attackers.

In reality, Smart Grid is divided into three main networks: operation, business, and customer networks. Each of these three networks has an individual set of communication subnetworks serving different functions. First, the operation network is used for maintaining the Grid functionality by the power companies. The second one, the business network, is used by the participants in the electricity market to regulate the market effectively and provide electricity services to the customers at large. The last part, the customer network, is used by the individual customers to manage their home energy to enhance electricity usage [3] . Due to the division of the Smart Grid networks in terms of communication, Smart Grid is divided into three areas: WAN, HAN, and NAN. WAN (Wide Area Network) provides communication links or interfaces between the NANs and the utility systems to transfer information. In its case, NAN (Neighborhood Area Network) connects multiple Hans to the local access points. In the case of HAN (Home Area Network), this communication is for end-user home or business communications [4] .

Attacks against the Smart Grid will likely differ from many traditional attacks against cyber environments. First, an attacker must be able to compromise the grid’s cyber elements. However, for the attack to cause negative system impact, the attacker must also know how to control the cyber elements in order to manipulate the physical system. Figure 3 demonstrates this relationship.

In the Smart Grid, the most severe threats related to the privacy deterioration of Smart Grid consumers include [15] [16] .

the risks, costs, and advantages of the SG systems, because of the demand for a higher level of security.

How Does Attack Happen in the Environments: The Seven Kill Chains

The cyber kill chain (CKC) is a classic cybersecurity model that is developed to better understand the stages an attack must go through to conduct an attack and help security teams stop an attack at each stage [17] . Figure 4 below shows the seven steps in the kill chain.

In this section, the tools/devices/materials, codes, algorithms, and Lab apparatus simulation techniques used for the Detection and Mitigation of Distributed Denial of Service (DDoS) attack in application to Smart Grid System have been discussed in detail.

1) The Materials, Devices and Tools

In this research, the strategy started by building the Flow Collector virtual machine (VM), Flow Sensor virtual machine (VM) and Stealthwatch management console virtual machine (VM) and then assigned IP addresses in accordance with the simulated communication Network designed model as shown in Figure 5 . The flow rate licenses is also one of the required components when deploying Stealthwatch analytics tool. Also, the attackers/source virtual machine (VM) and Target/destination virtual machine (VM) have also been built and assigned IP addresses per the simulated communication Network as well, and both can send and receive icmp/ping packets with no issues. The traffic between the attacker’s system and the target server has also been captured on the Stealthwatch management console under normal or baseline operation. The model setup already validated that traffic can go from attacker’s system to the target server and is captured on our Stealthwatch management console and thin client with no issues. We later then Installed or ingested DDoS payload/malicious codes on the attacker’s machine to carry out the DDoS operations on the target server/machine so that our model Stealthwatch tools can capture, detect, and mitigate the DDoS attack without any impact on the target system. In the simulation, once the flow level rises above the defined baseline on the target system based on our coding/algorithm, this will generate an alert to the administrator to take proper action before it affects the target server.

2) The Secure Network Analytics Components

Figure 5 below shows the materials samples of Secure Stealthwatch Analytics components used in this research to detect and mitigate DDoS attack in Smart Grid system.

3) Stealthwatch Analytics Tools Build

Flow Collector Build

Figure 6 below shows the process or steps used to build the flow collector used in this research.

After the VM has been assigned.

Step 1: Entering the configuration mode in the network option.

Step 2: Figure 7 below shows the steps to configure FC the IP address/hostname details as shown below:

IP address====192.168.232.206

Subnet Mask==255.255.255.192/6

Gateway=====192.168.232.193

Broadcast Address==192.168.232.225

Hostname========fm2lab-sw-fc01

Flow Senosr Build

Figure 8 below the process or steps used to build the flow sensor used in this research.

After the VM has been assigned:

Step 1: Entering the configuration mode in the Network option.

Step 2: Figure 9 below show the steps to configure FS the IP address/hostname details as shown below:

IP address====192.168.232.207

Subnet Mask==255.255.255.192/6

Gateway=====192.168.232.193

Broadcast Address==192.168.232.225

Hostname========fm2lab-sw-fs01

Stealthwatch Management Console Build

Figure 10 below shows the process or steps used to build the Stealthwatch

Management Console used in this research.

After the VM has been assigned:

Step 1: Entering the configuration mode in the Network option.

Step 2: Figure 11 below show the steps to configure Stealthwatch Management Console IP address/hostname details as shown below:

IP address====192.168.232.205

Subnet Mask==255.255.255.192/6

Gateway=====192.168.232.193

Broadcast Address==192.168.232.225

Hostname========fm2lab-sw-fs01

Attacker-Source Host1 Build

Figure 12 below is the set-up build for the attacker’s/Host1 VM used in this research. After the VM has been assigned:

Step 1: The IP addresses configurations info:

IP Address==192.168.232.209

Subnet Mask==255.255.255.192

Gateway=====192.168.232.193

Broadcast Address===192.168.232.255

Hostname========fm2lab-nsm

Step 2: System build

Target-Destination Host2 Build

Figure 13 below is the set-up build for the attacker’s/Host1 VM used in this research. After the VM has been assigned:

Step 1: The IP addresses configurations info:

IP Address==192.168.233.214

Subnet Mask==255.255.255.240

Gateway=====192.168.233.209

Broadcast Address===192.168.233.223

Hostname========ubuntu214

Step 2: System build

4) Proposed Design Using Stealthwatch Tools

Scenario Formation/Simulation Process

Figure 14 shows the Proposed Networked Smart Grid and its Communication Computer Network Design Using Stealthwatch which we considered in this research. In this network, we have chosen Host1 (192.168.232.209) as source and Host2 (192.168.233.214) as destination which is connected to Router R3 and R9. The routers R1 and R9 come under the Customer Edge networks.

Here, both Host1 and Host2 are connected to virtual machine which is created by VMWare. All other routers are coming under ISP Router. After creating the network, addresses were assigned as shown in the figure below. Here we choose

logical addressing scheme which is IP addressing and IPv4 addressing scheme is specifically used in this research which is subnetted by using VLSM to reduce the minimum wastage of IP’s. All the networks of the proposed architecture use IPv4 and are all connected to the network without any issues.

Once all the VMs have been built and addressed with IP details, Figure 15(a)

& Figure 15(b) then show the communication between the source node [attackers VM] to destination node [Target inside host] through our designed/proposed Stealthwatch network. To check the communication between the desired nodes in this research we use ping command, which works based on ICMP protocol. Based on echo request and echo reply between the source and destination we can find the communication status. Also, Figure 16 displays the ping status throughput though our Stealthwatch tool to confirm the communication success between the two VMs. The figure also validates the Stealthwatch capability to see the traffic passing the grid system.

5) Stealthwatch Smart Grid Firewall-IPS Rules, Security Event and Flowchart

During this research, Figure 17 below displays the firewall rule that was implemented in carrying out the research using Forcepoint next-generation Firewall.

The firewall rules displayed the access that was allowed between the attack system or source client and the target server or destination server. The default denial rule was placed at the bottom of the firewall rule as the best practice.

Figure 18 below displays the Intrusion Detection System (IPS) rules that were implemented during the course of this research for the protection and security of the entire Smart Grid system use case.

Figure 19 shows the remodified flowchart of cyber-attack algorithm using Stealthwatch. It details how Stealthwatch detects anomaly on the network and generate alerts based on the threshold volume level.

6) Optimization/Modification of Stealthwatch Codes & Flow Data for Smart Grid System

Figure 20 below shows the optimized/modified codes used for the implementations. The codes are used during the deployment of our Stealthwatch tool to set parameters based on baseline per traffic volume. This is a significant part of the research to detect when there is an anomaly in the Smart Grid system for immediate detection and mitigation before it affects the Grid System. It shows the baseline volume of flowrate ratio set to 15 pfs as baseline without DDoS

attack. When the flow rate ratio goes above 15 pfs, the alert/alarm sets in before the attack occurs.

In this section, our main concern and purpose of this simulation is to show the impact of DDoS attack in the proposed Smart Grid distribution network and how it is been detected, captured, and mitigated by our Secure Network Analytics (Stealthwatch) device/tools before it shuts down the grid completely. The data packets sent from Host1 to Host2 are captured using Stealthwatch central management console. Figure 21(a) and Figure 21(b) show the communication

between the source node-Host1 (Attacker) to destination node-Host2 (Target Server) through Smart Grid Stealthwatch computer network. The figure also shows that the attacker server (Host1) with IP address 192.168.232.209 is able to reach Host2 with IP address 192.168.233.214 and vice-versa through icmp/ping protocol.

1) Simulations Before the Attack Happened

Figure 21(a) and Figure 21(b) show the ping status between the attacker and Target systems during the simulation phases.

Figure 21(c) below shows that Stealthwatch Analytic tool is able to capture the communication between the attacker and the Target devices with no issues. Based on the echo request and echo reply between the source and destination, we can find the communication status.

2) Simulations During the Attack

Figure 22 below narrates the simulation results during and after the attack happpened. It displays the ingestion of malicious codes for DDoS attack in the attack system or source client in the form of excessive ping and port scan over 600 sockets as shown. This is to overwhelm and shut down the target or destination server. The figure also displays the Tcpdump simulation results that explain how the traffic is hitting the destination server per payload sent from the attack system. The TCPdump shows that the Attacker [Source Server-192.168.232.209] is constantly sending ping/port scans to Target [Destination Server-192.168.233.214] in order to overwhelm and shut it down.

3) Simulations After the Attack Had Happened

Figure 23(a) and Figure 23(b) below show the effects of the attack launched

on the attack system or destination server by the attack client or source system. The Stealthwath tool was able to detect the attack based on the volume of traffics, ports in use and how consistently the attacker was trying to break into the destination server or target.

Figure 23(c) shows the input and output flow logs comparison of the DDoS effect and how the tool is able to mitigate the attack before it shuts down the destination server. As soon as the flow rate ratio seems above 15 fps (flow per second) a bit, the system generates alerts to notify the administrator of any suspected attack to take any proper action if any slips as shown in Figure 23(d) . Thou, it has already mitigated the flow increase based on the baseline code/algorithm setup, Firewall rules and IPS policy setup.

Figure 23(e) shows the simulation flow output on Stealthwatch tool after the attack which displayed little or no increase in flow level based on baseline set. Thou, there was a little increase in flow due to the excessive pings/Port scan, but the administrator was able to get the alert immediately based on the code/algorithm set to notify, if the flow goes above a 15 pfs. This then caused the administrator to investigate further without causing any shutting down of the server.