MITRE ATT&CK Based Evaluation on In-Network Deception Technology for Modernized Electrical Substation Systems

Round 1

Reviewer 1 Report

The authors have proposed the trending topic of cybersecurity and they have investigated it on a real case, which is fully valuable. The paper has been organized well in all parts. The only drawback is related to the introduction. It is suggested to highlight the research gap and paper contributions for more clarity. It might be better to consider a separate subsection for that.

Author Response

Dear Reviewer,

Thank you very much for the time and effort for reviewing the manuscript. 

In response to your comment, I added a paragraph to highlight the contribution. Please review the second to the last paragraph (blue-colored) in the attached manuscript.

Regards,

Daisuke Mashima

Author Response File: Author Response.pdf

Reviewer 2 Report

This article needs improvement, here are my recommendations:
1. This paper is a proposal, as the authors themselves say so, so, change the title and insert the word proposal.
2. Update the references.
3. The paper has many abbreviations, including a list of nomenclatures.
4. Improve the conclusions, what is attractive to MDPI readers, why is this model better than others?

Author Response

Dear Reviewer,

I greatly appreciate your constructive comments to improve the manuscript. Please address my responses below.

1. This paper is a proposal, as the authors themselves say so, so, change the title and insert the word proposal.

Thank you very much for the comment. Because I didn't intend this is only proposal, I added text to highlight the contribution in the introduction. Please refer to the second to the last paragraph (blue-colored). Besides, I have updated the title accordingly.

2. Update the references.

Thank you very much for the suggestion. I have added more citations to be comprehensive. In particular, following the suggestions from the other reviewer, I have added discussion on stealthy false data injection attacks. Please see Section 2.3.4 and 4.3.4 (blue colored).

3. The paper has many abbreviations, including a list of nomenclatures.

Thank you very much for the great suggestion. I have added a table at the beginning of the paper.

4. Improve the conclusions, what is attractive to MDPI readers, why is this model better than others?

I appreciate your comment. I added text to highlight the suggested point. Please find text in blue color.

 

Author Response File: Author Response.pdf

Reviewer 3 Report

In this paper, the author showed that the cyber attacks against critical infrastructure are becoming stealthy and persistent. In order to counter such emerging attack vectors, deception technology was introduced. The author discussed one concrete design of the deception technology for IEC 61850 standard compliant smart substation systems in smart grid, named DecIED. This paper is relatively a nice review on the security problem and contains publicable materials. There are three comments for this paper:

1. The meaning of blue color in Figure 3-5 is not specified.

2. The robustness and vulnerability of control systems are critical in the discussion of cyber attacks. While the performance of control systems under stealthy attacks is rarely mentioned in this paper. There are many literatures on this topic, such as:

The performance and limitations of epsilon-stealthy attacks on higher order systems,” IEEE Trans. Autom. Control, vol. 62, no. 2, pp. 941–947, Feb. 2017.

The vulnerability of cyber-physical system under stealthy attacks. IEEE Transactions on Automatic Control, 2020, 66(2): 637-650.

On the performance degradation of cyber-physical systems under stealthy integrity attacks,  IEEE Trans. Autom. Control, vol. 61, no. 9, pp. 2618–2624, Sep. 2016.

The vulnerability of distributed state estimator under stealthy attacks. Automatica, 2021, 133: 109869.

3. The long compound sentence are always used in this paper, while they are not totally correct and easy reading. I am afraid the author should polish this.

Author Response

Dear Reviewer,

I greatly apprecaite your insightful comments and suggestions. Please find my responses below.

1. The meaning of blue color in Figure 3-5 is not specified.

Thank you very much for the catch. I added text in Section 4.1, and also added text to figure caption (in blue color).

2. The robustness and vulnerability of control systems are critical in the discussion of cyber attacks. While the performance of control systems under stealthy attacks is rarely mentioned in this paper.

Thank you very much for the suggestion. I added discussion about stealthy false data injection attacks (and citation) to Section 2.3.4 and 4.3.4. 

3. The long compound sentence are always used in this paper, while they are not totally correct and easy reading. I am afraid the author should polish this.

I'm sorry for the quality of the writing. I have made another careful proofreading to revise the sentences for better readability.

 

Author Response File: Author Response.pdf

Round 2

Reviewer 2 Report

The authors did all my suggestions.