Classification of Disturbances and Cyber-Attacks in Power Systems Using Heterogeneous Time-Synchronized Data

Abstract

Visualization and situational awareness are of vital importance for power systems, as the earlier a power-system event such as a transmission line fault or cyber-attack is identified, the quicker operators can react to avoid unnecessary loss. Accurate time-synchronized data, such as system measurements and device status, provide benefits for system state monitoring. However, the time-domain analysis of such heterogeneous data to extract patterns is difficult due to the existence of transient phenomena in the analyzed measurement waveforms. This paper proposes a sequential pattern mining approach to accurately extract patterns of power-system disturbances and cyber-attacks from heterogeneous time-synchronized data, including synchrophasor measurements, relay logs, and network event monitor logs. The term common path is introduced. A common path is a sequence of critical system states in temporal order that represent individual types of disturbances and cyber-attacks. Common paths are unique signatures for each observed event type. They can be compared to observed system states for classification. In this paper, the process of automatically discovering common paths from labeled data logs is introduced. An included case study uses the common path-mining algorithm to learn common paths from a fusion of heterogeneous synchrophasor data and system logs for three types of disturbances (in terms of faults) and three types of cyber-attacks, which are similar to or mimic faults. The case study demonstrates the algorithm's effectiveness at identifying unique paths for each type of event and the accompanying classifier's ability to accurately discern each type of event.Index Terms-Common paths, cyber-attack detection, disturbances, symmetric and unsymmetrical faults, synchrophasor data and device log mining. 1551-3203

Detecting cyberattacks in industrial control systems using online learning algorithms

“…Because the critical states are generally well known and limited in number, one can enumerate them formally beforehand and predict the criticality by tracking the changes in the distance between the current system state and the critical states. Likewise, Pan et al [31] processed a sequence of critical system states using a sequential pattern mining algorithm to detect disturbances and cyberattacks in power systems. In contrast to exploiting the abnormal patterns, one can also specify the acceptable behaviors of a system, and subsequently detect attacks that cause violation to them [34], [35].…”

Advanced Bad Data Injection Attack and Its Migration in Cyber-Physical Systems

“…The sequence pattern mining-based detector utilizes a series of state transitions to denote the normal system behaviors and abnormal system behaviors. An effective method has been proposed in the works by the authors of [26,27], where defenders compute the number of occurrences of every state transition path and use some methods to determine whether a path is normal. In general, the larger the number of occurrences is, the larger the possibility that it is a normal path.…”

A Fusion of Multiagent Functionalities for Effective Intrusion Detection System

“…The introduction of automatic discovery of common paths from the labeled data logs. Pan et al [26] presented the systematic approach for the design of hybrid IDS and learned the temporal based specifications. They proposed the common path mining algorithms for the learning.…”

“…Feature name (1) duration (2) protocol type (3) service (4) Flag (5) Src bytes (6) Dst bytes 7land (8) Wrong fragment (9) urgent (10) hot (11) Num failed logins (12) Logged.in (13) Num compromised (14) Root shell (15) Su attempted (16) Num root (17) Num file creations (18) Num shells (19) Num access files (20) Num outbound cmds (21) Is hot login (22) Is guest login (23) count (24) Srv count (25) Serror rate (26) Srv serror rate (27) Rerror (1) Gas pipeline 100,000 27 (2) Water tower 200,000 24…”

“…The comparison between proposed ARMA-IDS and traditional random forest, JRip, AdaBoost, and common path mining algorithms [26] on the parameters of accuracy, precision, recall, -measure, and the number of classes is as shown in Figure 7. The comparison yields the better results of accuracy, precision, recall, and -measure for a maximum number of classes.…”