Cyber and Physical Anomaly Detection in Smart-Grids

Marino, Daniel L.; Wickramasinghe, Chathurika S.; Amarasinghe, Kasun; Challa, Hari; Richardson, P. R. K.; Jillepalli, Ananth A.; Johnson, Brian K.; Rieger, Craig; Manic, Milos

doi:10.1109/rws47064.2019.8972003

Cited by 23 publications

(18 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…CPSs are a prime target for many cyber attack vectors such as Denial-of-Service (DOS), data injection, and interception schemes [17,18]. Anomaly Detection Systems (ADSs) are becoming a common component of CPSs which are implemented to detect anomalies in CPS networks [19].…”

Section: Related Workmentioning

confidence: 99%

“…Such systems typically take the form of a collection of interconnected physical and computing resources to accomplish a specific task. They integrate computational resources, communication, control, and physical processes into a single system [2,3]. Although the integration of cyber and physical systems has lead to improved efficiency, this integration makes CPS vulnerable to cybersecurity threats, leading to a degradation of resiliency [4].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Data-Driven Correlation of Cyber and Physical Anomalies for Holistic System Health Monitoring

Marino¹,

Wickramasinghe

Tsouvalas

et al. 2021

IEEE Access

Self Cite

View full text Add to dashboard Cite

Concerns of cyber-security threats are increasingly becoming a part of everyday operations of cyber-physical systems, especially in the context of critical infrastructures. However, despite the tight integration of cyber and physical components in modern critical infrastructures, the monitoring of cyber and physical subsystems is still done separately. For successful health monitoring of such systems, a holistic approach is needed. In this paper, we present an approach for holistic health monitoring of cyber-physical systems based on cyber and physical anomaly detection and correlation. We provide a data-driven approach for the detection of cyber and physical anomalies based on machine learning. The benefits of the presented approach are: 1) integrated architecture that supports acquisition and real-time analysis of both cyber and physical data; 2) a metric for holistic health monitoring that allows for differentiation between physical faults, cyber intrusion, and cyber-physical attacks. We present experimental analysis on a power-grid use case using the IEEE-33 bus model. The system was tested on several types of attacks such as network scan, Denial of Service (DOS), and malicious command injections.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Data-Driven Correlation of Cyber and Physical Anomalies for Holistic System Health Monitoring

Marino¹,

Wickramasinghe

Tsouvalas

et al. 2021

IEEE Access

Self Cite

View full text Add to dashboard Cite

show abstract

“…Marino et al [8] in their work presented a Cyber-Physical System called IREST (ICS Resilient Security Technology).…”

Section: Related Literature Workmentioning

confidence: 99%

“…e idea of standardizing the autonomous anomaly detection system based on unsupervised disentangled representation learning was developed based on the application of a single, universal method that will cover all industrial requirements while considering the high importance for heavy industry of continuous monitoring of the operational status of CPS [8]. is technique, which was presented and carefully examined, combines the most up-to-date artificial intelligence technologies to perform specific procedures of completely automated anomaly detection using an adaptive, flexible, and easy-to-use framework.…”

Section: Conversationmentioning

confidence: 99%

“…Detection of anomalies as a process is one of the biggest and most complex challenges in the management of largescale industrial applications, as the detection of equipment misuse can be due to several relevant or unrelated factors. e method's success, which can be attributed even when the nature of the problem is new and thus unknown, can be attributed to a strategy of comparing the current situation with a model or, more broadly, a set of specifications that are thought to describe its usual operation [8]. Behavioral analysis related to key CPS parameters such as load per node, the mean number of concurrent services, middle cycle length, and network performance is widely used to evaluate the results and identify the anomaly time-lapse, latency, bandwidth, throughput, packet loss rate, and so on [9].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

An Autonomous Cyber-Physical Anomaly Detection System Based on Unsupervised Disentangled Representation Learning

Guo

Wang

2021

Security and Communication Networks

View full text Add to dashboard Cite

Cyber-Physical Systems (CPS) in heavy industry are a combination of closely integrated physical processes, networking, and scientific computing. The physical production process is monitored and controlled by the CPS in question, through advanced real-time networking systems, where high-precision feedback loops can be changed when the overgrid of cooperative computing and communication components that make up the industrial process is required. These CPS operate independently but integrate interaction capabilities as well as with the external environment, creating the connection of the physical with the digital world. The outline is that the most effective modeling and development of high-reliability CPS are directly related to the maximization of the production process, extroversion, and industrial competition. In this paper, considering the high importance of the operational status of CPS for heavy industry, an innovative autonomous anomaly detection system based on unsupervised disentangled representation learning is presented. It is a temporal disentangled variational autoencoder (TDVA) which, mimicking the process of rapid human intuition, using high- or low-dimensional reasoning, finds and models the useful information independently, regardless of the given problem. Specifically, taking samples from the real data distribution representation space, separating them appropriately, and encoding them as separate disentangling dimensions create new examples that the system has not yet dealt with. In this way, first, it utilizes information from potentially inconsistent sources to learn the right representations that can then be broken down into subspace subcategories for easier and simpler categorization, and second, utilizing the latent representation of the model, it performs high-precision estimates of how similar or dissimilar the inputs are to each other, thus recognizing, with great precision and in a fully automated way, the system anomalies.

show abstract