On the practicality of detecting anomalies with encrypted traffic in AMI
Robin Berthiera b, David I. Urbinac, Álvaro A. Cárdenasc, Michael Guerreroc, Ulrich Herbergd e, Jorjeta G. Jetchevad e, Daisuke Mashimad e, Jun Ho Huhf, Rakesh B. Bobbaa b
- aUniversity of Illinois at Urbana-Champaign
- bUniversity of Illinois at Urbana Champaign
- cUniversity of Texas at Dallas
- dFujitsu Laboratories of America
- eFujitsu Labs. of America#TAB#
- fHoneywell Labs
Papers open inside SciRah from the original publisher or repository; SciRah never hosts them.
Abstract
Encryption is a key ingredient in the preservation of the confidentiality of network communications but can also be at odds with the mission of Intrusion Detection Systems (IDSes) to monitor traffic. This affects Advanced Metering Infrastructures (AMIs) too where the scale of the network and the sensitivity of communication make deploying IDSes along with encryption solutions mandatory. In this paper, we study four different approaches for reconciling the twin goals of confidentiality and monitoring by investigating their practical use on a set of real-world packet-level traces collected at an operational AMI network.