A Unified Deep Learning Anomaly Detection and Classification Approach for Smart Grid Environments

Siniosoglou, Ilias; Radoglou-Grammatikis, Panagiotis; Efstathopoulos, Georgios; Fouliras, Panayotis; Sarigiannidis, Panagiotis

doi:10.1109/tnsm.2021.3078381

Cited by 100 publications

(21 citation statements)

References 62 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Due to its documentation being readily available and it being used by modern and legacy substations (which form a significant percentage of substations worldwide [99]), Modbus TCP [100]-which is the TCP variant of Modbus [101]-is used. Furthermore, reinforcing our selection is the fact that there is current literature that is centred around its security [102], vulnerabilities [103], attack mitigation [104,105], and utilization in testbeds [106,107]. Utilizing TCP port 502, its implementation requires a client-server architecture.…”

Section: Modbus Tcpmentioning

confidence: 98%

A Trust-Influenced Smart Grid: A Survey and a Proposal

Boakye-Boateng

Ghorbani

Lashkari

2022

JSAN

View full text Add to dashboard Cite

A compromised Smart Grid, or its components, can have cascading effects that can affect lives. This has led to numerous cybersecurity-centric studies focusing on the Smart Grid in research areas such as encryption, intrusion detection and prevention, privacy and trust. Even though trust is an essential component of cybersecurity research; it has not received considerable attention compared to the other areas within the context of Smart Grid. As of the time of this study, we observed that there has neither been a study assessing trust within the Smart Grid nor were there trust models that could detect malicious attacks within the substation. With these two gaps as our objectives, we began by presenting a mathematical formalization of trust within the context of Smart Grid devices. We then categorized the existing trust-based literature within the Smart Grid under the NIST conceptual domains and priority areas, multi-agent systems and the derived trust formalization. We then proposed a novel substation-based trust model and implemented a Modbus variation to detect final-phase attacks. The variation was tested against two publicly available Modbus datasets (EPM and ATENA H2020) under three kinds of tests, namely external, internal, and internal with IP-MAC blocking. The first test assumes that external substation adversaries remain so and the second test assumes all adversaries within the substation. The third test assumes the second test but blacklists any device that sends malicious requests. The tests were performed from a Modbus server’s point of view and a Modbus client’s point of view. Aside from detecting the attacks within the dataset, our model also revealed the behaviour of the attack datasets and their influence on the trust model components. Being able to detect all labelled attacks in one of the datasets also increased our confidence in the model in the detection of attacks in the other dataset. We also believe that variations of the model can be created for other OT-based protocols as well as extended to other critical infrastructures.

show abstract

Section: Modbus Tcpmentioning

confidence: 98%

A Trust-Influenced Smart Grid: A Survey and a Proposal

Boakye-Boateng

Ghorbani

Lashkari

2022

JSAN

View full text Add to dashboard Cite

show abstract

“…The fusion between wavelet transform and deep residual networks is effective for fault diagnosis, as the vibration resulting from the faults can be evaluated through a series of combined frequency band techniques that result in an improvement of the model [42]. According to Siniosoglou et al [43], the detection of anomalies using deep learning strategies brings greater reliability in the diagnosis of the network condition.…”

Section: Related Work and Considered Datasetmentioning

confidence: 99%

Semi-ProtoPNet Deep Neural Network for the Classification of Defective Power Grid Distribution Structures

Stefenon

Singh

Yow

et al. 2022

Sensors

View full text Add to dashboard Cite

Power distribution grids are typically installed outdoors and are exposed to environmental conditions. When contamination accumulates in the structures of the network, there may be shutdowns caused by electrical arcs. To improve the reliability of the network, visual inspections of the electrical power system can be carried out; these inspections can be automated using computer vision techniques based on deep neural networks. Based on this need, this paper proposes the Semi-ProtoPNet deep learning model to classify defective structures in the power distribution networks. The Semi-ProtoPNet deep neural network does not perform convex optimization of its last dense layer to maintain the impact of the negative reasoning process on image classification. The negative reasoning process rejects the incorrect classes of an input image; for this reason, it is possible to carry out an analysis with a low number of images that have different backgrounds, which is one of the challenges of this type of analysis. Semi-ProtoPNet achieves an accuracy of 97.22%, being superior to VGG-13, VGG-16, VGG-19, ResNet-34, ResNet-50, ResNet-152, DenseNet-121, DenseNet-161, DenseNet-201, and also models of the same class such as ProtoPNet, NP-ProtoPNet, Gen-ProtoPNet, and Ps-ProtoPNet.

show abstract

“…In this case, a network is monitored and the extracted data is used in the posterior detection process [5][6][7]. Other application domains for anomaly-detection algorithms include, for example, cyber-physical systems (CPS) [2] or smart energy environments [16].…”

Section: Related Workmentioning

confidence: 99%

APT-Attack Detection Based on Multi-Stage Autoencoders

et al. 2022

View full text Add to dashboard Cite

In the face of emerging technological achievements, cyber security remains a significant issue. Despite the new possibilities that arise with such development, these do not come without a drawback. Attackers make use of the new possibilities to take advantage of possible security defects in new systems. Advanced-persistent-threat (APT) attacks represent sophisticated attacks that are executed in multiple steps. In particular, network systems represent a common target for APT attacks where known or yet undiscovered vulnerabilities are exploited. For this reason, intrusion detection systems (IDS) are applied to identify malicious behavioural patterns in existing network datasets. In recent times, machine-learning (ML) algorithms are used to distinguish between benign and anomalous activity in such datasets. The application of such methods, especially autoencoders, has received attention for achieving good detection results for APT attacks. This paper builds on this fact and applies several autoencoder-based methods for the detection of such attack patterns in two datasets created by combining two publicly available benchmark datasets. In addition to that, statistical analysis is used to determine features to supplement the anomaly detection process. An anomaly detector is implemented and evaluated on a combination of both datasets, including two experiment instances–APT-attack detection in an independent test dataset and in a zero-day-attack test dataset. The conducted experiments provide promising results on the plausibility of features and the performance of applied algorithms. Finally, a discussion is provided with suggestions of improvements in the anomaly detector.

show abstract

A Unified Deep Learning Anomaly Detection and Classification Approach for Smart Grid Environments

Cited by 100 publications

References 62 publications

A Trust-Influenced Smart Grid: A Survey and a Proposal

A Trust-Influenced Smart Grid: A Survey and a Proposal

Semi-ProtoPNet Deep Neural Network for the Classification of Defective Power Grid Distribution Structures

APT-Attack Detection Based on Multi-Stage Autoencoders

Contact Info

Product

Resources

About