Machine learning for power system disturbance and cyber-attack discrimination

Hink, Raymond Borges; Beaver, Justin M.; Buckner, Mark A.; Morris, Tommy; Adhikari, Uttam; Pan, Shengyi

doi:10.1109/isrcs.2014.6900095

Cited by 159 publications

(85 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…First, this work demonstrates a new classifier capable of distinguishing power-system disturbances and cyber security attacks that interrupt power-system control actions and mimic real disturbances. Compared to a similar work in [11], the method described in this paper provides precise classifications of fault types and the types of cyber-attacks with similar accuracy. Second, this work uses the common path-mining algorithm to mine fused heterogeneous data and create common paths for each known event type.…”

Section: Classification Of Disturbances and Cyber-attacks In Power Symentioning

confidence: 98%

“…Hardware-in-the-loop (HIL) simulation allows targeted dataset creation with realistic scenarios captured from the same commercial devices found in utilities. The same datasets used in this work have also been used in [11] for synchrophasor data-mining research.…”

Section: Classification Of Disturbances and Cyber-attacks In Power Symentioning

confidence: 99%

“…The K-nearest neighbor algorithm was used to classify three phase faults (3LG), voltage oscillation, and voltage sag scenarios in [11]. The algorithm accuracy is not provided in [12].…”

Section: Related Workmentioning

confidence: 99%

“…Multiple traditional data-mining algorithms were used to classify power-system faults and cyber-attacks in [11]. The authors of [11] used the same dataset for algorithm validation as that used for this paper.…”

Section: Related Workmentioning

confidence: 99%

See 3 more Smart Citations

Classification of Disturbances and Cyber-Attacks in Power Systems Using Heterogeneous Time-Synchronized Data

Pan

Morris

Adhikari

2015

IEEE Trans. Ind. Inf.

Self Cite

128

View full text Add to dashboard Cite

Visualization and situational awareness are of vital importance for power systems, as the earlier a power-system event such as a transmission line fault or cyber-attack is identified, the quicker operators can react to avoid unnecessary loss. Accurate time-synchronized data, such as system measurements and device status, provide benefits for system state monitoring. However, the time-domain analysis of such heterogeneous data to extract patterns is difficult due to the existence of transient phenomena in the analyzed measurement waveforms. This paper proposes a sequential pattern mining approach to accurately extract patterns of power-system disturbances and cyber-attacks from heterogeneous time-synchronized data, including synchrophasor measurements, relay logs, and network event monitor logs. The term common path is introduced. A common path is a sequence of critical system states in temporal order that represent individual types of disturbances and cyber-attacks. Common paths are unique signatures for each observed event type. They can be compared to observed system states for classification. In this paper, the process of automatically discovering common paths from labeled data logs is introduced. An included case study uses the common path-mining algorithm to learn common paths from a fusion of heterogeneous synchrophasor data and system logs for three types of disturbances (in terms of faults) and three types of cyber-attacks, which are similar to or mimic faults. The case study demonstrates the algorithm's effectiveness at identifying unique paths for each type of event and the accompanying classifier's ability to accurately discern each type of event.Index Terms-Common paths, cyber-attack detection, disturbances, symmetric and unsymmetrical faults, synchrophasor data and device log mining. 1551-3203

show abstract

Section: Classification Of Disturbances and Cyber-attacks In Power Symentioning

confidence: 98%

Section: Classification Of Disturbances and Cyber-attacks In Power Symentioning

confidence: 99%

“…The K-nearest neighbor algorithm was used to classify three phase faults (3LG), voltage oscillation, and voltage sag scenarios in [11]. The algorithm accuracy is not provided in [12].…”

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

Classification of Disturbances and Cyber-Attacks in Power Systems Using Heterogeneous Time-Synchronized Data

Pan

Morris

Adhikari

2015

IEEE Trans. Ind. Inf.

Self Cite

128

View full text Add to dashboard Cite

show abstract

“…These methods have become increasingly effective at detecting sophisticated attacks by analyzing both the profile of the attacks and the damage as it unfolds [6]. Attacks of limited impact, when quickly contained, may be acceptable if used to learn more effective defenses [7]. When firewalls are deficient, methods based on machine learning and AI operate like drugs in the human body, and can quickly identify and mitigate the effect of viruses and worms [10,11].…”

Section: Introductionmentioning

confidence: 99%

Can Ternary Computing Improve Information Assurance?

et al. 2018

View full text Add to dashboard Cite

Abstract:Modern computer microarchitectures build on well-established foundations that have encouraged a pattern of computational homogeneity that many cyberattacks depend on. We suggest that balanced ternary logic can be valuable to Internet of Things (IoT) security, authentication of connected vehicles, as well as hardware and software assurance, and have developed a ternary encryption scheme between a computer and smartcard based on public key exchange through non-secure communication channels to demonstrate the value of balanced ternary systems. The concurrent generation of private keys by the computer and the smartcard uses ternary schemes and cryptographic primitives such as ternary physical unclonable functions. While general purpose ternary computers have not succeeded in general use, heterogeneous computing systems with small ternary computing units dedicated to cryptographic functions have the potential to improve information assurance, and may also be designed to execute binary legacy codes.

show abstract