A Smart Grid AMI Intrusion Detection Strategy Based on Extreme Learning Machine

Zhang, Ke; Zhi, Hu; Zhan, Yufei; Wang, Xiaofen; Guo, Keyi

doi:10.3390/en13184907

Cited by 34 publications

(13 citation statements)

References 41 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…, t im ] T ∈ R m is the intended output vector, where n denotes the number of features contained in the input sample, and m is the training sample's total number of classes. Additionally, since this single hidden layer neural network includes L hidden nodes, the output of the network may be expressed as follows [52]:…”

Section: Elmmentioning

confidence: 99%

Smart Attacks Learning Machine Advisor System for Protecting Smart Cities from Smart Threats

2022

View full text Add to dashboard Cite

The extensive use of Internet of Things (IoT) technology has recently enabled the development of smart cities. Smart cities operate in real-time to improve metropolitan areas’ comfort and efficiency. Sensors in these IoT devices are immediately linked to enormous servers, creating smart city traffic flow. This flow is rapidly increasing and is creating new cybersecurity concerns. Malicious attackers increasingly target essential infrastructure such as electricity transmission and other vital infrastructures. Software-Defined Networking (SDN) is a resilient connectivity technology utilized to address security concerns more efficiently. The controller, which oversees the flows of each appropriate forwarding unit in the SDN architecture, is the most critical component. The controller’s flow statistics are thought to provide relevant information for building an Intrusion Detection System (IDS). As a result, we propose a five-level classification approach based on SDN’s flow statistics to develop a Smart Attacks Learning Machine Advisor (SALMA) system for detecting intrusions and for protecting smart cities from smart threats. We use the Extreme Learning Machine (ELM) technique at all levels. The proposed system was implemented on the NSL-KDD and KDDCUP99 benchmark datasets, and achieved 95% and 99.2%, respectively. As a result, our approach provides an effective method for detecting intrusions in SDNs.

show abstract

Section: Elmmentioning

confidence: 99%

Smart Attacks Learning Machine Advisor System for Protecting Smart Cities from Smart Threats

2022

View full text Add to dashboard Cite

show abstract

“…Shen et al [ 34 ] applied an extreme learning machine (ELM) to intrusion detection, which was found to improve the detection speed and generalization ability of the model. In the research by Zhang et al [ 35 ], a smart grid intrusion detection model that combines the genetic algorithm (GA) and ELM was proposed. The model retains the advantages of the ELM, and the GA is introduced to ensure the optimal parameters of the model.…”

Section: Related Workmentioning

confidence: 99%

“…In AMI, the characteristic distribution of normal electricity information is very regular [ 35 ] and has obvious periodicity [ 29 ], while abnormal electricity information does not have these characteristics. Therefore, this paper proposes a cross-layer feature-fusion CNN-LSTM intrusion detection model, the architecture of which is illustrated in Figure 1 .…”

Section: System Componentsmentioning

confidence: 99%

Intrusion Detection System in the Advanced Metering Infrastructure: A Cross-Layer Feature-Fusion CNN-LSTM-Based Approach

Yao

Wang

Liu

et al. 2021

Sensors

View full text Add to dashboard Cite

Among the key components of a smart grid, advanced metering infrastructure (AMI) has become the preferred target for network intrusion due to its bidirectional communication and Internet connection. Intrusion detection systems (IDSs) can monitor abnormal information in the AMI network, so they are an important means by which to solve network intrusion. However, the existing methods exhibit a poor ability to detect intrusions in AMI, because they cannot comprehensively consider the temporal and global characteristics of intrusion information. To solve these problems, an AMI intrusion detection model based on the cross-layer feature fusion of a convolutional neural networks (CNN) and long short-term memory (LSTM) networks is proposed in the present work. The model is composed of CNN and LSTM components connected in the form of a cross-layer; the CNN component recognizes regional features to obtain global features, while the LSTM component obtain periodic features by memory function. The two types of features are aggregated to obtain comprehensive features with multi-domain characteristics, which can more accurately identify intrusion information in AMI. Experiments based on the KDD Cup 99 and NSL-KDD datasets demonstrate that the proposed cross-layer feature-fusion CNN-LSTM model is superior to other existing methods.

show abstract

“…Marbet [15] proposed a method that determines intrusions by analyzing network packet data with deep learning in AMI's Host Intrusion Detection System (HIDS) and Network Intrusion Detection System (NIDS). Zhang [16] proposed a system that detects intrusions by learning network packet data with an Extreme Learning Machine (ELM). Furthermore, Souza [17] proposed a method by which to detect energy theft by modeling residential and commercial consumers using Self-Organizing Maps (SOM) and Multiplayer Perceptron (MP)-ANN and learning the consumers' energy consumption rates per hour.…”

Section: Security On Advanced Metering Infrastructurementioning

confidence: 99%

Cyber Threat Intelligence Framework for Incident Response in an Energy Cloud Platform

Gong

Lee

2021

Electronics

View full text Add to dashboard Cite

Advanced information technologies have transformed into high-level services for more efficient use of energy resources through the fusion with the energy infrastructure. As a part of these technologies, the energy cloud is a technology that maximizes the efficiency of energy resources through the organic connection between the entities that produce and consume the energy. However, the disruption or destruction of energy cloud systems through cyberattacks can lead to incidents such as massive blackouts, which can lead to national disasters. Furthermore, since the technique and severity of modern cyberattacks continue to improve, the energy cloud environment must be designed to resist cyberattacks. However, since the energy cloud environment has different characteristics from general infrastructures such as the smart grid and the Advanced Metering Infrastructure (AMI), it requires security technology specialized to its environment. This paper proposes a cyber threat intelligence framework to improve the energy cloud environment’s security. Cyber Threat Intelligence (CTI) is a technology to actively respond to advanced cyber threats by collecting and analyzing various threat indicators and generating contextual knowledge about the cyber threats. The framework proposed in this paper analyzes threat indicators that can be collected in the advanced metering infrastructure and proposes a cyber threat intelligence generation technique targeting the energy cloud. This paper also proposes a method that can quickly apply a security model to a large-scale energy cloud infrastructure through a mechanism for sharing and spreading cyber threat intelligence between the AMI layer and the cloud layer. Our framework provides a way to effectively apply the proposed technologies through the CTI architecture, including the local AMI layer, the station layer, and the cloud layer. Furthermore, we show that the proposed framework can effectively respond to cyber threats by showing a 0.822 macro-F1 score and a 0.843 micro-F1 score for cyberattack detection in an environment that simulates a model of an attacker and an energy cloud environment.

show abstract

A Smart Grid AMI Intrusion Detection Strategy Based on Extreme Learning Machine

Cited by 34 publications

References 41 publications

Smart Attacks Learning Machine Advisor System for Protecting Smart Cities from Smart Threats

Smart Attacks Learning Machine Advisor System for Protecting Smart Cities from Smart Threats

Intrusion Detection System in the Advanced Metering Infrastructure: A Cross-Layer Feature-Fusion CNN-LSTM-Based Approach

Cyber Threat Intelligence Framework for Incident Response in an Energy Cloud Platform

Contact Info

Product

Resources

About