Unveiling the Operation and Configuration of a Real-World Bulk Substation Network

Electrical substations are distributed points where operators can monitor and control the power grid. In this paper, we perform the first in-depth study of the operation of a large (500 KV) real-world substation automation network. We provide a view of how these critical networks operate using packet captures and a Substation Configuration Description (SCD) file. We discuss the challenges we overcame to reconstruct a network with redundant paths, gateways, serial legacy devices, and sophisticated intelligent electronic devices (IEDs). Our work provides a deep-dive discussion of these critical networks in a real-world system and sheds light on their operation, configuration and security.