Abstract:In recent decades, cyber security issues in IEC 61850-compliant substation automation systems (SASs) have become growing concerns. Many researchers have developed various strategies to detect malicious behaviours of SASs during the system operational stage, such as anomaly-based detection. However, most existing anomaly-based detection methods identify an abnormal behaviour by checking every single network packet without any association. These traditional methods cannot effectively detect “stealthy” attacks which modify legitimate messages slightly while imitating patterns of benign behaviours. In this paper, we present feature selection and extraction methods to generalise and summarise critical features when detecting insider attacks triggering from untrusted control devices within SASs. By applying a sliding window-based sequential classification mechanism, our detection method can detect anomalies across multiple devices without the need to learn datasets collected from all devices. Firstly, to generalise critical features and summarise systems’ behaviours so that it is unnecessary to collect all datasets, we selected and extracted six critical network features from generic object-oriented substation events (GOOSE) messages and seven summarised physical features based on the general architecture of the primary plant of distribution substations. After that, to improve detection accuracy and reduce computational costs, we applied sliding window algorithms to divide datasets into different overlapped window-based snippets. Then we applied a sequential classification model based on Bidirectional Long Short-Term Memory networks to train and test those datasets. As a result, our method can detect insider attacks across multiple devices accurately with a false-negative rate of less than 1%.

An Intelligent Secure Fault Classification and Identification Scheme for Mining Valuable Information in IIoT

Text Classification and Threat Intelligence Generation for Industrial Control System Security

Design and application of intelligent equipment management platform

Research and Evaluation of Intelligent Threat Detection Under Industrial Internet

System Statistics Learning-Based IoT Security: Feasibility and Suitability

Research on vibration monitoring and fault diagnosis of rotating machinery based on internet of things technology

An LSTM Based Malicious Traffic Attack Detection in Industrial Internet

Empowering IoT Predictive Maintenance Solutions With AI: A Distributed System for Manufacturing Plant-Wide Monitoring

Malicious Traffic Classification via Edge Intelligence in IIoT

Intelligent Fault Diagnosis for Industrial Big Data

Online Intrusion Detection for IoT Systems with Full Bayesian Possibilistic Clustering and Ensembled Fuzzy Classifiers

Fault Diagnosis Method for a Mine Hoist in the Internet of Things Environment

Design of Equipment Online Monitoring and Fault Diagnosis Platform Based on IOT

Real-time fault detection for IIoT facilities using GA-Att-LSTM based on edge-cloud collaboration

Research on machine learning-based device fingerprint recognition technology for power internet of things

A Deep One-Class Intrusion Detection Scheme in Software-Defined Industrial Networks

Online Anomaly Detection of Industrial IoT Based on Hybrid Machine Learning Architecture

Deep learning-based intrusion detection approach for securing industrial Internet of Things

Anomaly Detection for Insider Attacks From Untrusted Intelligent Electronic Devices in Substation Automation Systems

Fault diagnosis methods for multi-layer edge computing systems

Anomaly events classification and detection system in critical industrial internet of things infrastructure using machine learning algorithms