Machine Learning based Post Event Analysis for Cybersecurity of Cyber-Physical System

Kuchan Park,Junho Hong,Wencong Su,HyoJong Lee

2024-03-08

Abstract:As Information and Communication Technology (ICT) equipment continues to be integrated into power systems, issues related to cybersecurity are increasingly emerging. Particularly noteworthy is the transition to digital substations, which is shifting operations from traditional hardwired-based systems to communication-based Supervisory Control and Data Acquisition (SCADA) system operations. These changes in the power system have increased the vulnerability of the system to cyber-attacks and emphasized its importance. This paper proposes a machine learning (ML) based post event analysis of the power system in order to respond to these cybersecurity issues. An artificial neural network (ANN) and other ML models are trained using transient fault measurements and cyber-attack data on substations. The trained models can successfully distinguish between power system faults and cyber-attacks. Furthermore, the results of the proposed ML-based methods can also identify 10 different fault types and the location where the event occurred.

Systems and Control

What problem does this paper attempt to address?

This paper aims to address the issue of network security in power systems, particularly with the integration of information technology and the rise of digital substations, which has increased the vulnerability of the system to network attacks. The paper proposes a machine learning (ML)-based post-event analysis approach to tackle the challenges of network security. By training an artificial neural network (ANN) and other ML models using transient fault measurement data from substations and network attack data, the approach can differentiate between power system faults and network attacks. Additionally, the method can identify 10 different fault types and the location of the events. The paper first introduces the difficulties faced by traditional methods in distinguishing network attacks from regular faults, and then proposes an ML algorithm that compares voltage, current, phase, and frequency data to determine whether an event is a real fault or a network attack. The effectiveness of this approach is demonstrated through training and validation using data generated on the IEEE 14-node system, including accurate identification in N-1 emergency situations. The main contributions of this paper are as follows: 1. Effectively differentiate between faults and network attacks by comparing ML algorithms on data from the attacked substation and its neighboring substations. 2. Identify 10 different fault types and determine the fault location. 3. Although currently focused on N-1 emergency situations, the approach may be extended to larger interruption scenarios and applied to larger-scale systems in the future. The paper describes the flowchart of the method and evaluates the performance of several ML models, including decision tree (DT), support vector machine (SVM), k-nearest neighbors (KNN), and artificial neural network (ANN). The results show that ANN performs the best in various scenarios, with 100% accuracy, precision, recall, and F1 score. The effectiveness of the method under different fault and network attack scenarios is demonstrated through real-time verification on an HIL testbed. Future work includes using data from larger-scale systems, training more diverse ML models, and further validation in real-time environments.

Machine Learning based Post Event Analysis for Cybersecurity of Cyber-Physical System

Machine Learning Based Cyber System Restoration for IEC 61850 Based Digital Substations

Analysis of Malware-Induced Cyber Attacks in Cyber-Physical Power Systems

An Ensemble Learning-Based Cyber-Attacks Detection Method of Cyber-Physical Power Systems

Machine Learning to detect cyber-attacks and discriminating the types of power system disturbances

Advancing Cyber-Attack Detection in Power Systems: A Comparative Study of Machine Learning and Graph Neural Network Approaches

Cybersecurity Analysis of Data-Driven Power System Stability Assessment

A Collaborative Characteristic Event Sequence Based Identification Method for Cyberattacks in Cyber-Physical System

A review on machine learning techniques for secured cyber-physical systems in smart grid networks

IEEE 1815.1-Based Power System Security With Bidirectional RNN-Based Network Anomalous Attack Detection for Cyber-Physical System

Deep Machine Learning Model-Based Cyber-Attacks Detection in Smart Power Systems

Tracking Real-time Anomalies in Cyber-Physical Systems Through Dynamic Behavioral Analysis

Advanced Machine Learning-Driven Security and Anomaly Identification in Inverter-Based Cyber-Physical Microgrids

Hybrid Statistical-Machine Learning for Real-Time Anomaly Detection in Industrial Cyber–Physical Systems

Cyber Security in Power Systems Using Meta-Heuristic and Deep Learning Algorithms

Machine learning for cybersecurity in smart grids: A comprehensive review-based study on methods, solutions, and prospects

Attack Graph Model for Cyber-Physical Power Systems using Hybrid Deep Learning

Review of Cybersecurity Analysis in Smart Distribution Systems and Future Directions for Using Unsupervised Learning Methods for Cyber Detection

A Deep Learning based Detection Method for Combined Integrity-Availability Cyber Attacks in Power System

Mitigating Missing Rate and Early Cyberattack Discrimination Using Optimal Statistical Approach with Machine Learning Techniques in a Smart Grid

Is Machine Learning in Power Systems Vulnerable?