  While digitization of distribution grids through information and
communications technology brings numerous benefits, it also increases the
grid's vulnerability to serious cyber attacks. Unlike conventional systems,
attacks on many industrial control systems such as power grids often occur in
multiple stages, with the attacker taking several steps at once to achieve its
goal. Detection mechanisms with situational awareness are needed to detect
orchestrated attack steps as part of a coherent attack campaign. To provide a
foundation for detection and prevention of such attacks, this paper addresses
the detection of multi-stage cyber attacks with the aid of a graph-based cyber
intelligence database and alert correlation approach. Specifically, we propose
an approach to detect multi-stage attacks by leveraging heterogeneous data to
form a knowledge base and employ a model-based correlation approach on the
generated alerts to identify multi-stage cyber attack sequences taking place in
the network. We investigate the detection quality of the proposed approach by
using a case study of a multi-stage cyber attack campaign in a
future-orientated power grid pilot.
