Multi-Source Multi-Domain Data Fusion for Cyberattack Detection in Power Systems

Abstract

Modern power systems equipped with advanced communication infrastructure are cyberphysical in nature. The traditional approach of leveraging physical measurements for detecting cyberinduced physical contingencies are insufficient to reflect the accurate cyber-physical states. Moreover, deploying conventional rule-based and anomaly-based intrusion detection systems for cyberattack detection results in higher false positives. Hence, independent usage of detection tools of cyberattacks in cyber and physical sides has a limited capability. In this work, a mechanism to fuse real-time data from cyber and physical domains, to improve situational awareness of the whole system is developed. It is demonstrated how improved situational awareness can help reduce false positives in intrusion detection. This cyber and physical data fusion results in cyber-physical state space explosion which is addressed using different feature transformation and selection techniques. Our fusion engine is further integrated into a cyber-physical power system testbed as an application that collects cyber and power system telemetry from multiple sensors emulating real-world data sources found in a utility. These are synthesized into features for algorithms to detect cyber intrusions. Results are presented using the proposed data fusion application to infer False Data and Command Injection (FDI and FCI)-based Man-in-The-Middle attacks. Post collection, the data fusion application uses time-synchronized merge and extracts features. This is followed by pre-processing such as imputation, categorical encoding, and feature reduction, before training supervised, semi-supervised, and unsupervised learning models to evaluate the performance of the intrusion detection system. A major finding is the improvement of detection accuracy by fusion of features from cyber, security, and physical domains. Additionally, it is observed that the semi-supervised co-training technique to perform at par with supervised learning methods with the proposed feature vector. The approach and toolset as well as the dataset that are generated can be utilized to prevent threats such as false data or command injection attacks from being carried out by identifying cyber intrusions accurately.

Inter-Domain Fusion for Enhanced Intrusion Detection in Power Systems: An Evidence Theoretic and Meta-Heuristic Approach

“…A distributive and collaborative-based IDS is proposed using DSTE for fusion data from multiple nodes [20], where the detection is done collaboratively and the decision is distributed among all nodes. The presented work, IDEA-I, is the first to leverage DS theory for the purpose of classification based on the dataset [11] generated from Man-in-The-Middle (MiTM) attacks in a cyber-physical power system testbed [21]. DSTE suffers from major drawbacks of its computational requirements and the challenges it encounters while eliciting the probability masses from multiple evidence [13].…”

“…Different Supervised Learning (SL)-based classifiers are used in the Data Fusion Engine [ 11 ]. The probability scores based on the classifier’s output for each data point are considered for computing the mass function from each evidence.…”

“…The evidences are collected at three locations: DNP3 Master, Substation Router, and server hosting PWDS. Details on the testbed’s architecture, use cases, and fusion are published in [ 11 , 21 , 33 ], respectively.…”

“…The major contributions of this paper are as follows: A cyber-physical power system intrusion detection system IDEA-I is proposed that improves intrusion detection by inferring cyber-physical state information to improve situational awareness based on the fundamentals of DSTE, various rules of fusion, and decision criteria. A method for computing mass functions for stochastic cyber-physical parameters, from the detection probability computed in our prior work on data fusion [ 11 ], is proposed and evaluated in IDEA-I. The performance based on two different architectures, location and location-cum-domain based fusion, using IDEA-I is evaluated.…”

“…A method for computing mass functions for stochastic cyber-physical parameters, from the detection probability computed in our prior work on data fusion [ 11 ], is proposed and evaluated in IDEA-I. The performance based on two different architectures, location and location-cum-domain based fusion, using IDEA-I is evaluated.…”