Abstract:In recent decades, cyber security issues in IEC 61850-compliant substation automation systems (SASs) have become growing concerns. Many researchers have developed various strategies to detect malicious behaviours of SASs during the system operational stage, such as anomaly-based detection. However, most existing anomaly-based detection methods identify an abnormal behaviour by checking every single network packet without any association. These traditional methods cannot effectively detect “stealthy” attacks which modify legitimate messages slightly while imitating patterns of benign behaviours. In this paper, we present feature selection and extraction methods to generalise and summarise critical features when detecting insider attacks triggering from untrusted control devices within SASs. By applying a sliding window-based sequential classification mechanism, our detection method can detect anomalies across multiple devices without the need to learn datasets collected from all devices. Firstly, to generalise critical features and summarise systems’ behaviours so that it is unnecessary to collect all datasets, we selected and extracted six critical network features from generic object-oriented substation events (GOOSE) messages and seven summarised physical features based on the general architecture of the primary plant of distribution substations. After that, to improve detection accuracy and reduce computational costs, we applied sliding window algorithms to divide datasets into different overlapped window-based snippets. Then we applied a sequential classification model based on Bidirectional Long Short-Term Memory networks to train and test those datasets. As a result, our method can detect insider attacks across multiple devices accurately with a false-negative rate of less than 1%.

Towards feature engineering for intrusion detection in IEC–61850 communication networks

Intrusion Detection Model of SCADA Using Graphical Features

Multidimensional Intrusion Detection System for IEC 61850-Based SCADA Networks

Real-Time Intrusion Detection Based on Decision Fusion in Industrial Control Systems

Deep Feature Extraction in Intrusion Detection System

Anomaly Detection for Insider Attacks From Untrusted Intelligent Electronic Devices in Substation Automation Systems

A Hierarchical Intrusion Detection System for Industrial Control Networks based on EtherNet/IP

Leveraging Data Fitting and Trust Assessment to Improve the Security of Industrial Networks

Novel Framework for an Intrusion Detection System Using Multiple Feature Selection Methods Based on Deep Learning

Standard specification-based intrusion detection for hierarchical industrial control systems

Intelligent Differential Evolution based Feature Selection with Deep Neural Network for Intrusion Detection in Wireless Sensor Networks

A Two Stage Intrusion Detection System for Industrial Control Networks Based on Ethernet/IP

Toward an Applied Cyber Security Solution in IoT-Based Smart Grids: An Intrusion Detection System Approach

Feature engineering and deep learning-based intrusion detection framework for securing edge IoT

Enhanced Anomaly Detection in Industrial Control Systems aided by Machine Learning

Feature selection for intrusion detection systems

Intrusion Detection in Industrial Internet of Things Network-Based on Deep Learning Model with Rule-Based Feature Selection

Assessment of Cyber-Physical Intrusion Detection and Classification for Industrial Control Systems

Deep Learning-Based Intrusion Detection System for Advanced Metering Infrastructure

Using machine learning to detect network intrusions in industrial control systems: a survey

Stateful Intrusion Detection for IEC 60870-5-104 SCADA Security