Detecting Cyber Attacks in Smart Grids Using Semi-Supervised Anomaly Detection and Deep Representation Learning

Abstract

Smart grids integrate advanced information and communication technologies (ICTs) into traditional power grids for more efficient and resilient power delivery and management, but also introduce new security vulnerabilities that can be exploited by adversaries to launch cyber attacks, causing severe consequences such as massive blackout and infrastructure damages. Existing machine learning-based methods for detecting cyber attacks in smart grids are mostly based on supervised learning, which need the instances of both normal and attack events for training. In addition, supervised learning requires that the training dataset includes representative instances of various types of attack events to train a good model, which is sometimes hard if not impossible. This paper presents a new method for detecting cyber attacks in smart grids using PMU data, which is based on semi-supervised anomaly detection and deep representation learning. Semi-supervised anomaly detection only employs the instances of normal events to train detection models, making it suitable for finding unknown attack events. A number of popular semi-supervised anomaly detection algorithms were investigated in our study using publicly available power system cyber attack datasets to identify the best-performing ones. The performance comparison with popular supervised algorithms demonstrates that semi-supervised algorithms are more capable of finding attack events than supervised algorithms. Our results also show that the performance of semi-supervised anomaly detection algorithms can be further improved by augmenting with deep representation learning.

Effective One-Class Classifier Model for Memory Dump Malware Detection

“…Table 3 depicts the comparison between OCC-PCA and TOCC models. Both [15] and [23]'s models employed the PCA classifier, although their findings were less conclusive than in this study. In [15], which provided the SIMCA and OCSVM models.…”

“…This model did not apply dimensionality reduction automatically on their datasets. Furthermore, in [23], a unique method for exploiting PMU data to detect cyberattacks on smart grids was suggested and built. It uses publicly accessible datasets on power system hacks and is based on semi-supervised anomaly identification.…”

CADeSH: Collaborative Anomaly Detection for Smart Homes

“…The recall is also very high (it is actually perfect for cryptomining execution detection), while the FPR has a relatively low value of 0.014 for both of the evaluated attacks. For benchmarking, we compared our two-step method with a variety of classical one-step algorithms widely used for anomaly and novelty detection in general [42], [87]- [90], and for IoT attack detection in particular [19], [91]. Two of these algorithms are the building blocks of CADeSH (namely, AE and k-means clustering, which we used to implement F ilter m 1 and F ilter m 2 , respectively).…”

A Comprehensive Review of Cybersecurity in Inverter-Based Smart Power System Amid the Boom of Renewable Energy

“…A similar application [126] helps detect stealthy FDIA on four IEEE distribution network models. But in [127], compared with supervised learning algorithms, Isolation Forest shows worse performance with the higher false-positive rate on a reduced-dimension dataset which includes both natural contingencies and attack events.…”