PAVED: Perturbation Analysis for Verification of Energy Data

Culler, Megan; Davis, Katherine; Sahu, Abhijeet

doi:10.1109/smartgridcomm.2019.8909800

Cited by 3 publications

(3 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Hence, such solutions cannot detect cyber-induced stealth false data injection attacks. Several works on false data injection detection are based on machine learning [38]- [41] and deep learning [42]- [47] techniques. The authors in [48] address stealthy attacks using multi-dimensional data fusion by collecting information from the power consumption of physical devices, control operation and system states feed to the cascade detection algorithm to identify stealthy attacks using Long Short Term Memory.…”

Section: Data Fusion In Power Systemsmentioning

confidence: 99%

Multi-Source Multi-Domain Data Fusion for Cyberattack Detection in Power Systems

Sahu

Mao

Wlazlo³

et al. 2021

IEEE Access

Self Cite

View full text Add to dashboard Cite

Modern power systems equipped with advanced communication infrastructure are cyberphysical in nature. The traditional approach of leveraging physical measurements for detecting cyberinduced physical contingencies are insufficient to reflect the accurate cyber-physical states. Moreover, deploying conventional rule-based and anomaly-based intrusion detection systems for cyberattack detection results in higher false positives. Hence, independent usage of detection tools of cyberattacks in cyber and physical sides has a limited capability. In this work, a mechanism to fuse real-time data from cyber and physical domains, to improve situational awareness of the whole system is developed. It is demonstrated how improved situational awareness can help reduce false positives in intrusion detection. This cyber and physical data fusion results in cyber-physical state space explosion which is addressed using different feature transformation and selection techniques. Our fusion engine is further integrated into a cyber-physical power system testbed as an application that collects cyber and power system telemetry from multiple sensors emulating real-world data sources found in a utility. These are synthesized into features for algorithms to detect cyber intrusions. Results are presented using the proposed data fusion application to infer False Data and Command Injection (FDI and FCI)-based Man-in-The-Middle attacks. Post collection, the data fusion application uses time-synchronized merge and extracts features. This is followed by pre-processing such as imputation, categorical encoding, and feature reduction, before training supervised, semi-supervised, and unsupervised learning models to evaluate the performance of the intrusion detection system. A major finding is the improvement of detection accuracy by fusion of features from cyber, security, and physical domains. Additionally, it is observed that the semi-supervised co-training technique to perform at par with supervised learning methods with the proposed feature vector. The approach and toolset as well as the dataset that are generated can be utilized to prevent threats such as false data or command injection attacks from being carried out by identifying cyber intrusions accurately.

show abstract

Section: Data Fusion In Power Systemsmentioning

confidence: 99%

Multi-Source Multi-Domain Data Fusion for Cyberattack Detection in Power Systems

Sahu

Mao

Wlazlo³

et al. 2021

IEEE Access

Self Cite

View full text Add to dashboard Cite

show abstract

“…There has been a lot of work around detection of FDI attacks. Perturbation analysis is one good way to detect if SCADA data has been compromised [57,58,59,60]. This work could be extended from defending state estimation to defending against attacks specific to DER.…”

Section: Fdi Detectionmentioning

confidence: 99%

Securing Distributed Energy Resource Integration

Culler

2021

Self Cite

View full text Add to dashboard Cite

The penetration of distributed energy resources (DER) is growing at much higher rates than predicted 20 years ago. Far from being used only in residential settings, DER are now installed on distribution and transmission circuits. In this position, they do not have the same properties as traditional generators and are more flexible in many cases. The growing penetration and range of uses for DER motivate the need to reliably and safely integrate them into the grid. Operators must be able to rely on them not only for normal operation, but also during abnormal conditions like black starts or adverse cyber scenarios. To that end, we study the communications, device interfaces, and potential consequences of DER operation under abnormal and adversarial conditions. The weaknesses of communications networks are studied based on the industrial protocols used, and the benefits of security features are examined. The device interfaces are found to be vulnerable to attack based on the requirements in the IEEE-1547 standard for DER interconnection and interoperability, which is expected to be adopted in the next ten years. In addition to exploring the requirements of the standard, we show that these vulnerabilities and others do exist and can be used maliciously in a modern storage system DER. Consequences of these vulnerabilities range from exacerbated grid instability, to simultaneous loss of large portions of DER penetration, to physical damage to inverters or DER themselves and other sensitive equipment. We tie these outcomes to specific attacker actions in an effort to give operators a better threat intelligence view that allows them to prioritize mitigations. Finally, we discuss mitigations that could prevent many of the adversarial scenarios described. Some solutions can be added to existing infrastructure, while others may require longer term planning for grid modernization with consideration for security.

show abstract

“…Hence, such solutions cannot detect cyber induced stealth false data injection attacks. Several works on false data injection detection are based on machine learning [23]- [26] and deep learning [27]- [32] techniques. The authors in [33] address stealthy attacks using multi-dimensional data fusion by collecting information from power consumption of physical devices, control operation and system states feed to the cascade detection algorithm to identify stealthy attack using Long Short Term Memory (LSTM).…”

Section: B Multi-sensor Fusion Applicationsmentioning

confidence: 99%

Multi-Source Data Fusion for Cyberattack Detection in Power Systems

Sahu,

Mao,

Wlazlo

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

can cause a severe impact on power systems unless detected early. However, accurate and timely detection in critical infrastructure systems presents challenges, e.g., due to zero-day vulnerability exploitations and the cyberphysical nature of the system coupled with the need for high reliability and resilience of the physical system. Conventional rule-based and anomaly-based intrusion detection system (IDS) tools are insufficient for detecting zero-day cyber intrusions in the industrial control system (ICS) networks. Hence, in this work, we show that fusing information from multiple data sources can help identify cyber-induced incidents and reduce false positives. Specifically, we present how to recognize and address the barriers that can prevent the accurate use of multiple data sources for fusion-based detection. We perform multi-source data fusion for training IDS in a cyber-physical power system testbed where we collect cyber and physical side data from multiple sensors emulating real-world data sources that would be found in a utility and synthesizes these into features for algorithms to detect intrusions. Results are presented using the proposed data fusion application to infer False Data and Command injectionbased Man-in-The-Middle (MiTM) attacks. Post collection, the data fusion application uses time-synchronized merge and extracts features followed by pre-processing such as imputation and encoding before training supervised, semi-supervised, and unsupervised learning models to evaluate the performance of the IDS. A major finding is the improvement of detection accuracy by fusion of features from cyber, security, and physical domains. Additionally, we observed the co-training technique performs at par with supervised learning methods when fed with our features.

show abstract

PAVED: Perturbation Analysis for Verification of Energy Data

Cited by 3 publications

References 21 publications

Multi-Source Multi-Domain Data Fusion for Cyberattack Detection in Power Systems

Multi-Source Multi-Domain Data Fusion for Cyberattack Detection in Power Systems

Securing Distributed Energy Resource Integration

Multi-Source Data Fusion for Cyberattack Detection in Power Systems

Contact Info

Product

Resources

About