Anomaly Detection in Smart Metering Infrastructure with the Use of Time Series Analysis

Abstract

The article presents solutions to anomaly detection in network traffic for critical smart metering infrastructure, realized with the use of radio sensory network. The structure of the examined smart meter network and the key security aspects which have influence on the correct performance of an advanced metering infrastructure (possibility of passive and active cyberattacks) are described. An effective and quick anomaly detection method is proposed. At its initial stage, Cook's distance was used for detection and elimination of outlier observations. So prepared data was used to estimate standard statistical models based on exponential smoothing, that is, Brown's, Holt's, and Winters' models. To estimate possible fluctuations in forecasts of the implemented models, properly parameterized Bollinger Bands was used. Next, statistical relations between the estimated traffic model and its real variability were examined to detect abnormal behavior, which could indicate a cyberattack attempt. An update procedure of standard models in case there were significant real network traffic fluctuations was also proposed. The choice of optimal parameter values of statistical models was realized as forecast error minimization. The results confirmed efficiency of the presented method and accuracy of choice of the proper statistical model for the analyzed time series.

Review of Smart Meter Data Analytics: Applications, Methodologies, and Challenges

“…How to use data analytics method to model the outages and reliability indices from weather data was discussed in [132]. Apart from the data analytics method for outage management, more works on smart meter data-based outage managements have been adopted to the corresponding communication architectures [175] [176].…”

Smart Grids Data Analysis: A Systematic Mapping Study

“…C9. Security Intrusion detection ( [8], [15], [52], [74], [76], [77], [143], [148], [209]),false data injection attacks ( [13], [16], [17], [31], [100], [119], [151], [163], [168], [184], [185], [230], [251], [257]), energy theft ( [54], [99], [169], [191], [254], [258]), distinguishing cyber-attacks from physical faults ( [18])…”

“…C9. Security Intrusion detection ( [8], [15], [52], [74], [76], [77], [143], [148], [209]),false data injection attacks ( [13], [16], [17], [31], [100], [119], [151], [163], [168], [184], [185], [230], [251], [257]), energy theft ( [54], [99], [169], [191], [254], [258]), distinguishing cyber-attacks from physical faults ( [18]) C10. SG failures fault status detection [41], [46], [61], [62], [126], [127], [142], [176], fault type classification [197], power distribution reliability [149], [195] As it can be seen, there is large variability in the aspects covered by the research.…”

“…Privacy Fuzzy c-means clustering [85], Random Gaussian Noise [105], Colored Noise [217], Symmetric Geometric Noise [21], Secret Sharing Scheme [95],Elliptic Curve Based Data Aggregation (ECBDA) [238], Collaborative Anonymity Set Formation (CASF) [4], Wavelet-based Multi-resolution Analysis (MRA) [141], adversarial strategy algorithm [234], differentially private aggregated sums [97], Integer Linear Optimization (ILP) [39], Tolerable Deviation algorithm [89], partitioning algorithm [235], Haar Wavelet transform [72], Profile Matching protocol using Hamming distance [236], Kalman filter [216] C9. Security Principal Component Analysis (PCA) (8) ( [16]- [18], [74], [100], [148], [185], [257]), Support Vector Machines (SVM) (5) ( [18], [74], [151], [185], [258]), k-means clustering [13], [251], fuzzy c-means clustering [185], DBSCAN clustering [148], [185], Decision Trees [52], [54], Feedforward Neural Network (FFNN) [143], Multi-layer Perceptron (MLP) [185], k-Nearest Neighbor (kNN) [185], clustering-based anomaly detection [209], Ensemble Model [143], Exponential Smoothing [15], Hoeffding Tree…”

Future smart grid communication-deployment of IoT: opportunities and challenges

“…Interference in the communication channel is one of the main challenges [45]. Personal area networks are most probably installed in suburban area, HAN is used for a home automation application, it should have enhanced network security to make sure that essential and correct real time information is communicate to the smart meter [46]. HAN/LAN/FAN is directly connected to Smart meters, sensors, PMUs, due to same frequency band of different technologies interference occur between networks and causes unreal and unreliable transmission of signals from smart meters, to eliminate this problem, research on developing algorithms to decrease interference is one of the challenges [47].…”