Fig. 3
From: An integrated testbed for locally monitoring SCADA systems in smart grids
Scheme of the testbed: the simulated part and the network components are shown. Figure 3 outlines the testbed. The simulated physical components are used as “ground truth” and depicted above the dashed line. The network components, including the source of malicious commands, are illustrated below the dashed line. The trusted parts are colored green and the untrusted parts red. The physical and the cyber parts are connected via a single physical connection (denoted A). The correspondence between the sensors and the actuators in the cyber part, to their values output by the power distribution simulator (power flow equations and topology), are indicated by dashed arrows, labeled B and C respectively. Traffic generated by the hacker reaches the Modbus RTU device only via the Bro monitor. The monitor then applies the safety and consistency checks before the command or sensor reading is put forward to the simulated physical part and included in the power distribution simulator