Abstract:In recent decades, cyber security issues in IEC 61850-compliant substation automation systems (SASs) have become growing concerns. Many researchers have developed various strategies to detect malicious behaviours of SASs during the system operational stage, such as anomaly-based detection. However, most existing anomaly-based detection methods identify an abnormal behaviour by checking every single network packet without any association. These traditional methods cannot effectively detect “stealthy” attacks which modify legitimate messages slightly while imitating patterns of benign behaviours. In this paper, we present feature selection and extraction methods to generalise and summarise critical features when detecting insider attacks triggering from untrusted control devices within SASs. By applying a sliding window-based sequential classification mechanism, our detection method can detect anomalies across multiple devices without the need to learn datasets collected from all devices. Firstly, to generalise critical features and summarise systems’ behaviours so that it is unnecessary to collect all datasets, we selected and extracted six critical network features from generic object-oriented substation events (GOOSE) messages and seven summarised physical features based on the general architecture of the primary plant of distribution substations. After that, to improve detection accuracy and reduce computational costs, we applied sliding window algorithms to divide datasets into different overlapped window-based snippets. Then we applied a sequential classification model based on Bidirectional Long Short-Term Memory networks to train and test those datasets. As a result, our method can detect insider attacks across multiple devices accurately with a false-negative rate of less than 1%.

Intrusion Detection Method Based on the Legality of Action Messages in Process Layer of Smart Substation

Malicious Code Detection on Smart Meters -A Side-Channel Based Approach

Abnormal Message Logic & Sequence Detection for Process Layer Network in Digital Substation

Anomoly Detection for PLC Based on Magnetic Side Channel

CP Fusion based Abnormal Traffic Dedection for Process Layer Network in Digital Substation

State Machine Based Malicious Packet Attack Detection and Security Situation Assessment

A Protection Method Based on Message Identification and Flow Monitoring for Managing the Congestion Arising from Network Attacks on Smart Substation

Study and Verification of Covert Channels for Process Layer Network in Smart Substations

An alert fusion-based smart grid attack detection method

A Collaborative Characteristic Event Sequence Based Identification Method for Cyberattacks in Cyber-Physical System

Anomaly Detection for Insider Attacks From Untrusted Intelligent Electronic Devices in Substation Automation Systems

Digital Substation Cyber Security Analysis with Syn-Flood Attack As A Simulation Case

Multidimensional Intrusion Detection System for IEC 61850-Based SCADA Networks

Distributed Intrusion Detection System in a Multi-Layer Network Architecture of Smart Grids

Intelligent alarm processing and fault diagnosis in digital substations

FARIMA Model-Based Communication Traffic Anomaly Detection in Intelligent Electric Power Substations

Machine Learning Assisted Bad Data Detection for High-throughput Substation Communication

Unified Modeling of Physical- Cyber -Logic -Attack - Protection for Digital Substation by Extension of IEC61850 Logic Space Model

Message Flow Modeling Analysis and Application for Digital Substation Process Layer Network

Abnormal Traffic-Indexed State Estimation: A Cyber-Physical Fusion Approach for Smart Grid Attack Detection

Detection Technique for Power System under Cyber Attack