Abstract:In recent decades, cyber security issues in IEC 61850-compliant substation automation systems (SASs) have become growing concerns. Many researchers have developed various strategies to detect malicious behaviours of SASs during the system operational stage, such as anomaly-based detection. However, most existing anomaly-based detection methods identify an abnormal behaviour by checking every single network packet without any association. These traditional methods cannot effectively detect “stealthy” attacks which modify legitimate messages slightly while imitating patterns of benign behaviours. In this paper, we present feature selection and extraction methods to generalise and summarise critical features when detecting insider attacks triggering from untrusted control devices within SASs. By applying a sliding window-based sequential classification mechanism, our detection method can detect anomalies across multiple devices without the need to learn datasets collected from all devices. Firstly, to generalise critical features and summarise systems’ behaviours so that it is unnecessary to collect all datasets, we selected and extracted six critical network features from generic object-oriented substation events (GOOSE) messages and seven summarised physical features based on the general architecture of the primary plant of distribution substations. After that, to improve detection accuracy and reduce computational costs, we applied sliding window algorithms to divide datasets into different overlapped window-based snippets. Then we applied a sequential classification model based on Bidirectional Long Short-Term Memory networks to train and test those datasets. As a result, our method can detect insider attacks across multiple devices accurately with a false-negative rate of less than 1%.

Using Power Side-Channel to Implement Anomaly-Based Intrusion Detection on Smart Grid Terminals

Malicious Code Detection on Smart Meters -A Side-Channel Based Approach

Real-time Monitoring of Smart Grid Terminals Based on Multi-dimensional Information Fusion

ADDP: Anomaly Detection for DTU Based on Power Consumption Side-Channel

Terminal Security Monitoring Based on Power Consumption Information

Power IoT System Security Monitoring Based on Power Consumption Side Channel Information.

An Anomaly Detection Algorithm for the Power Industrial Terminal Security Monitoring

Power Consumption-based Anomaly Detection for Relay Protection

Non-intrusive Runtime Monitoring for Power System Intelligent Terminal Based on Improved Deep Belief Networks (I-DBN)

Anomoly Detection for PLC Based on Magnetic Side Channel

Malicious Code Detection Scheme Based on CWRNN for Microgrid Controllers

Power-Based Non-Intrusive Condition Monitoring for Terminal Device in Smart Grid

Research on Power Terminal Security Monitoring Method Based on Business Logic Consistency

Attack Detection for Distributed Photovoltaic Generation Systems Leveraging Cyber and Power Side Channel Data

A Machine Learning Approach for Anomaly Detection to Secure Smart Grid Systems

NIPAD: a Non-Invasive Power-Based Anomaly Detection Scheme for Programmable Logic Controllers

Anomaly Detection in Smart Grids using Machine Learning

Anomaly Detection for Insider Attacks From Untrusted Intelligent Electronic Devices in Substation Automation Systems

Research on Deep Detection Technology of Abnormal Behavior of Power Industrial Control System

Anomaly-based Framework for Detecting Power Overloading Cyberattacks in Smart Grid AMI

Encryption-Aware Anomaly Detection in Power Grid Communication Networks