Abstract:Substation communication network (SCN) provides real-time, high-speed, and reliable data transmissions for the advanced monitoring and control functionalities, which are facing increasing cyberspace threats and attacks. Efficient threat perception and cyber situational awareness are essential to enhance secure and reliable SCN operations. This article explores multiscale SCN traffic pattern characteristics with holistic network traffic, separated network traffic for included devices (especially IoT devices) and separated network traffic of certain types of protocol. The proposed online traffic-oriented SCN traffic anomaly detection and cyber situational awareness models are designed for the network anomalies and cyber-attacks that could cause network traffic pattern variations. We leverage a fractional autoregressive integration moving average (FARIMA)-based dynamic threshold model to detect abnormal traffic patterns without sophisticated computations or deep packet inspection. The SCN real-time operation conditions are timely quantified through the statistical methods with the alliance of SCN topology and protocols. The cyber situational awareness model is further carried out to evaluate the most affected protocol and security risks of various devices in SCN using Grubbs' test. The experiment results are carried out based on a real 110-kV intelligent power substation. The numerical results confirm the comparative low mean square error (MSE) and low complexity of the online traffic characterization when forecasting holistic network traffic and separated network traffics. Furthermore, the timely and quantified cybersecurity risk analysis is conducted based on the SCN traffic with varying scales to detect cyberspace threats and identify the high-risk SCN devices and the most affected protocol.

An external network modeling approach for online security analysis

State Estimation Based External Network Solution for on-line Security Analysis

New method for on-line modelling of electric loads

Network Model Reconstruction in Online Security Early Warning System

Stability Analysis Model for Multi-Node Undersea Observation Networks

A New Approach to Modeling and Analyzing Security of Networked Systems

Research on modeling method of power system network security risk assessment based on object-oriented Bayesian network

A Novel Modeling Method for Analysis of IP Networks

A Stochastic Model for Quantitative Security Analyses of Networked Systems.

Identification of Critical Links Based on Electrical Betweenness and Neighborhood Similarity in Cyber-Physical Power Systems

Multi-Scale Traffic Aware Cybersecurity Situational Awareness Online Model for Intelligent Power Substation Communication Network

An Online Preventive Control Method for Power Flow Unsolvability

Energy Internet Oriented Static Security Analysis Method for Multi-Energy Flow

Multi-area state estimation for active distribution networks under multiple uncertainties: An affine approach

Modelling and Analysis of Network Security - an Algebraic Approach

Security Evaluation Techniques and Network Performance Simulation Based on Queue Model

Online multi-fault power system dynamic security assessment driven by hybrid information of anticipated faults and pre-fault power flow

Observability Analysis in Power System State Estimation Based on the Solvable Condition of Power Flow

Modeling Load Redistribution Attacks in Power Systems

Security Analysis of Power System Network Based on Complex Network