Intrusion Evaluation of Communication Network Architectures for Power Substations

FARIMA model‐based communication traffic anomaly detection in intelligent electric power substations

“…The cyber-attacks in the electric power substations can affect the pattern of data traffic in SCN, as confirmed by related studies (e.g. [13]). For example, in the recent cyber-attacks in Ukrainian and Israeli power grids [14], the BlackEnergy-led combo attacks and a series of malicious code injection have paralysed the communications network, blocked critical channels, manipulated SCADA systems and delayed the substation systems recovery process.…”

“…The data traffic exhibits diverse patterns and characteristics in the underlying SCN in the substation [13, 18] and the main characteristics are summarised as follows: Self‐similarity and long range dependence: It refers to the fact that a wide range of complexities can be observed in a small range [19]. The relationship between the Hurst parameter H and the time series data properties can be described as the following cases: in the case of , the sequence tends to be anti‐persistence and ergodicity and exhibits a mean value return tendency, which is more sudden and volatile than the random sequence.…”

A Review of the Methods Used to Model Traffic Flow in a Substation Communication Network

“…Initially, a brief review of intelligent substations based on the IEC 61850 standards, as well as a discussion of the characteristics of SCN data traffic is provided. As SCNs are required for the intelligent function of electrical substations, and diverse communication patterns are exhibited by SCN data traffic, the characteristics of the SCN data are essential and are utilised in the model developed [45], [46], [47]. SCN data traffic can be considered with the following characteristics [45], [48]: 1.…”

Research on network intrusion detection technology in dynamic and complex background

“…We can connect search engine of the anomaly detection in the form of plug-ins, thus facilitating the abnormal detection for the intrusion detection technology system. We compare the data from the anomaly detection engine and the simulated data model calculated by the cluster analysis, while recording and editing the source of the data to facilitate the effective tracking [10] . Figure 2 is the flow chart of the anomaly detection.…”