Abstract:Substation communication network (SCN) provides real-time, high-speed, and reliable data transmissions for the advanced monitoring and control functionalities, which are facing increasing cyberspace threats and attacks. Efficient threat perception and cyber situational awareness are essential to enhance secure and reliable SCN operations. This article explores multiscale SCN traffic pattern characteristics with holistic network traffic, separated network traffic for included devices (especially IoT devices) and separated network traffic of certain types of protocol. The proposed online traffic-oriented SCN traffic anomaly detection and cyber situational awareness models are designed for the network anomalies and cyber-attacks that could cause network traffic pattern variations. We leverage a fractional autoregressive integration moving average (FARIMA)-based dynamic threshold model to detect abnormal traffic patterns without sophisticated computations or deep packet inspection. The SCN real-time operation conditions are timely quantified through the statistical methods with the alliance of SCN topology and protocols. The cyber situational awareness model is further carried out to evaluate the most affected protocol and security risks of various devices in SCN using Grubbs' test. The experiment results are carried out based on a real 110-kV intelligent power substation. The numerical results confirm the comparative low mean square error (MSE) and low complexity of the online traffic characterization when forecasting holistic network traffic and separated network traffics. Furthermore, the timely and quantified cybersecurity risk analysis is conducted based on the SCN traffic with varying scales to detect cyberspace threats and identify the high-risk SCN devices and the most affected protocol.

An Abnormal Traffic Detection Method in Smart Substations Based on Coupling Field Extraction and DBSCAN

Traffic features extraction and clustering analysis for abnormal behavior detection.

CP Fusion based Abnormal Traffic Dedection for Process Layer Network in Digital Substation

Research on the detection of abnormal traffic for multi-channel network

Abnormal traffic detection system in SDN based on deep learning hybrid models

Abnormal Traffic-Indexed State Estimation: A Cyber-Physical Fusion Approach for Smart Grid Attack Detection

A new methodology for anomaly detection of attacks in IEC 61850-based substation system

Detecting Anomalies in Distributed Control Systems by Modeling Traffic Behaviors

Methods of real-time screening and reconstruction for dynamic traffic abnormal data

A Novel Approach for Traffic Anomaly Detection in Power Distributed Control System and Substation System.

Anomalous Trafifc Detection Based on Trafifc Behavior Characteristics

An Anomaly Detection Approach Based on Traffic Prediction and Correlation Coefficient for WSN

Detecting Distributed Network Traffic Anomaly with Network-Wide Correlation Analysis

Multi-Scale Traffic Aware Cybersecurity Situational Awareness Online Model for Intelligent Power Substation Communication Network

Methods of Anomaly State Detection for Power Systems Based on Bilateral Cyber‐physical Information

A Transform Domain-Based Anomaly Detection Approach To Network-Wide Traffic

A New Multistage Approach to Detect Subtle DDoS Attacks.

The abnormal traffic detection scheme based on PCA and SSH

Abnormal Data Detection and Identification Method of Distribution Internet of Things Monitoring Terminal Based on Spatiotemporal Correlation

A Time-Frequency Detecting Method for Network Traffic Anomalies

FARIMA Model Based Analysis of Communication Traffic Anomaly in Smart Substation