Abstract:In recent decades, cyber security issues in IEC 61850-compliant substation automation systems (SASs) have become growing concerns. Many researchers have developed various strategies to detect malicious behaviours of SASs during the system operational stage, such as anomaly-based detection. However, most existing anomaly-based detection methods identify an abnormal behaviour by checking every single network packet without any association. These traditional methods cannot effectively detect “stealthy” attacks which modify legitimate messages slightly while imitating patterns of benign behaviours. In this paper, we present feature selection and extraction methods to generalise and summarise critical features when detecting insider attacks triggering from untrusted control devices within SASs. By applying a sliding window-based sequential classification mechanism, our detection method can detect anomalies across multiple devices without the need to learn datasets collected from all devices. Firstly, to generalise critical features and summarise systems’ behaviours so that it is unnecessary to collect all datasets, we selected and extracted six critical network features from generic object-oriented substation events (GOOSE) messages and seven summarised physical features based on the general architecture of the primary plant of distribution substations. After that, to improve detection accuracy and reduce computational costs, we applied sliding window algorithms to divide datasets into different overlapped window-based snippets. Then we applied a sequential classification model based on Bidirectional Long Short-Term Memory networks to train and test those datasets. As a result, our method can detect insider attacks across multiple devices accurately with a false-negative rate of less than 1%.

Anomoly Detection for PLC Based on Magnetic Side Channel

NIPAD: a Non-Invasive Power-Based Anomaly Detection Scheme for Programmable Logic Controllers

Adversarial Attacks and Mitigation for Anomaly Detectors of Cyber-Physical Systems

Malicious Code Detection on Smart Meters -A Side-Channel Based Approach

Reverse Engineering Physical Semantics of PLC Program Variables Using Control Invariants.

Malicious Code Detection Scheme Based on CWRNN for Microgrid Controllers

Square Wave Attack Detection Based on PCA with Cosine Similarity and SVM

Power Consumption-based Anomaly Detection for Relay Protection

ADDP: Anomaly Detection for DTU Based on Power Consumption Side-Channel

Deceptive attack detection of control system using multi-scale principal component analysis

An Anomaly Detection Algorithm for the Power Industrial Terminal Security Monitoring

Detecting PLC Intrusions Using Control Invariants

Implementation and Detection of Novel Attacks to the PLC Memory of a Clean Water Supply System

Mode division-based anomaly detection against integrity and availability attacks in industrial cyber-physical systems

Detection and Analysis Technique for Manipulation Attacks on PLC Control Logic

Side-channel based intrusion detection for industrial control systems

Anomaly Detection for Insider Attacks From Untrusted Intelligent Electronic Devices in Substation Automation Systems

Unsupervised Ensemble Methods for Anomaly Detection in PLC-based Process Control

Using Power Side-Channel to Implement Anomaly-Based Intrusion Detection on Smart Grid Terminals

A Survey on Programmable Logic Controller Vulnerabilities, Attacks, Detections, and Forensics

Mismatched Control and Monitoring Frequencies: Vulnerability, Attack, and Mitigation