Neural Net-Based Anomaly Detection System in Substation Networks

Kreimel, Philipp; Tavolato, Paul

doi:10.14236/ewic/icscsr19.6

Cited by 5 publications

(4 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Basumallik et al [147] propose a CNN-based anomaly detector to identify False Data Injection Attacks (FDIA) against PMU-based state estimators. The proposed classifier extracts features from time series data, collected from PMU data packets aggregated in PDCs, and exploits the strong correlations of spatio-temporal changes in voltage Kreimel and Tavolato [148] present an anomaly detection system for electrical substations. The system captures real-time network packets of substation devices and extracts relevant features, selected based on information gain.…”

Section: B Cyber-detection For Telecontrol Horizontal or Wampac Commu...mentioning

confidence: 99%

See 1 more Smart Citation

Smart Substation Communications and Cybersecurity: A Comprehensive Survey

Gaspar

Cruz

Lam

et al. 2023

IEEE Commun. Surv. Tutorials

View full text Add to dashboard Cite

Electrical grids generate, transport, distribute and deliver electrical power to consumers through a complex Critical Infrastructure which progressively shifted from an air-gaped to a connected architecture. Specifically, Smart Substations are important parts of Smart Grids, providing switching, transforming, monitoring, metering and protection functions to offer a safe, efficient and reliable distribution of electrical power to consumers. The evolution of electrical power grids was closely followed by the digitization of all its parts and improvements in communication and computing infrastructures, leading to an evolution towards digital smart substations with improved connectivity. However, connected smart substations are exposed to cyber threats which can result in blackouts and faults which may propagate in a chain reaction and damage electrical appliances connected across the electrical grid. This work organizes and offers a comprehensive review of architectural, communications and cybersecurity standards for smart substations, complemented by a threat landscape analysis and the presentation of a Defense-in-Depth strategy blueprint. Furthermore, this work examines several defense mechanisms documented in the literature, existing datasets, testbeds and evaluation methodologies, identifying the most relevant open issues which may guide and inspire future research work.

show abstract

Section: B Cyber-detection For Telecontrol Horizontal or Wampac Commu...mentioning

confidence: 99%

“…In addition, most methods do not offer a sufficiently low false detection rate nor high detection rate performances required by critical systems [100,127,130,135,136,140,145,146,147,148,149,150]. False detections overwhelm cybersecurity professionals and eventually create a mistrust sentiment and relaxed security measures.…”

Section: Critical Analysismentioning

confidence: 99%

Smart Substation Communications and Cybersecurity: A Comprehensive Survey

Gaspar

Cruz

Lam

et al. 2023

IEEE Commun. Surv. Tutorials

View full text Add to dashboard Cite

show abstract

“…This includes the application of machine learning (e.g., neural networks) to analyze network traffic information such as round-trip times, packet sizes, or IP addresses as well as the derivation of expert rules from SCL files to check IP addresses, TCP ports, IDs, sequence numbers, and state numbers. Most of these approaches focus on the process bus communication within the substation, including sampled values and GOOSE messages [16][17][18][19][20][21].…”

Section: Cyber-attack Detection In Power Transmission Systemsmentioning

confidence: 99%

Combined Network Intrusion and Phasor Data Anomaly Detection for Secure Dynamic Control Centers

Kummerow

2022

Energies

View full text Add to dashboard Cite

The dynamic operation of power transmission systems requires the acquisition of reliable and accurate measurement and state information. The use of TCP/IP-based communication protocols such as IEEE C37.118 or IEC 61850 introduces different gateways to launch cyber-attacks and to compromise major system operation functionalities. Within this study, a combined network intrusion and phasor data anomaly detection system is proposed to enable a secure system operation in the presence of cyber-attacks for dynamic control centers. This includes the utilization of expert-rules, one-class classifiers, as well as recurrent neural networks to monitor different network packet and measurement information. The effectiveness of the proposed network intrusion and phasor data anomaly detection system is shown within a real-time simulation testbed considering multiple operation and cyber-attack conditions.

show abstract

“…For example, an attacker may get access to an operator's credentials and use them to send commands to disrupt the physical process. To address such a challenge, researchers have proposed physical process-based anomaly detection algorithms [12,26,27]. This approach can identify attacks from compromised workstations.…”

Section: Background and Related Workmentioning

confidence: 99%

Automated detection-in-depth in industrial control systems

Jadidi

Foo

Hussain

et al. 2021

Int J Adv Manuf Technol

View full text Add to dashboard Cite

Legacy industrial control systems (ICSs) are not designed to be exposed to the Internet and linking them to corporate networks has introduced a large number of cyber security vulnerabilities. Due to the distributed nature of ICS devices, a detection-in-depth strategy is required to simultaneously monitor the behaviour of multiple sources of ICS data. While a detection-in-depth method leads to detecting attacks, like flooding attacks in earlier phases before the attacker can reach the end target, most research papers have focused on anomaly detection based on a single source of ICS data. Here, we present a detection-in-depth method for an ICS network. The new method is called automated flooding attack detection (AFAD) which consists of three stages: data acquisition, pre-processing, and a flooding anomaly detector. Data acquisition includes data collection from different sources like programmable logic controller (PLC) logs and network traffic. We then generate NetFlow data to provide light-weight anomaly detection in ICS networks. NetFlow-based analysis has been used as a scalable method for anomaly detection in high-speed networks. It only analyses packet headers, and it is an efficient method for detecting flooding attacks like denial of service attacks, and its performance is not affected by encrypted data. However, it has not been sufficiently studied in industrial control systems. Besides NetFlow data, ICS device logs are a rich source of information that can be used to detect abnormal behaviour. Both NetFlow traffic and log data are processed in our pre-processing stage. The third stage of AFAD is anomaly detection which consists of two parallel machine learning analysis methods, which respectively analyse the behaviours of device logs and NetFlow records. Due to the lack of enough labelled training datasets in most environments, an unsupervised predictor and an unsupervised clustering method are respectively used in the anomaly detection stage. We validated our approach using traffic captured in a factory automation dataset, Modbus dataset, and SWAT dataset. These datasets contain physical and network level normal and abnormal data. The performance of AFAD was compared with single-layer anomaly detection and with other studies. Results showed the high precision of AFAD in detecting flooding attacks.

show abstract

Neural Net-Based Anomaly Detection System in Substation Networks

Cited by 5 publications

References 12 publications

Smart Substation Communications and Cybersecurity: A Comprehensive Survey

Smart Substation Communications and Cybersecurity: A Comprehensive Survey

Combined Network Intrusion and Phasor Data Anomaly Detection for Secure Dynamic Control Centers

Automated detection-in-depth in industrial control systems

Contact Info

Product

Resources

About