Towards anomaly detection in smart grids by combining Complex Events Processing and SNMP objects

Abstract

This paper describes the architecture and the fundamental methodology of an anomaly detector, which by continuously monitoring Simple Network Management Protocol data and by processing it as complex-events, is able to timely recognize patterns of faults and relevant cyber-attacks. This solution has been applied in the context of smart grids, and in particular as part of a security and resilience component of the Information and Communication Technologies (ICT) Gateway, a middleware-based architecture that correlates and fuses measurement data from different sources (e.g., Inverters, Smart Meters) to provide control coordination and to enable grid observability applications. The detector has been evaluated through experiments, where we selected some representative anomalies that can occur on the ICT side of the energy distribution infrastructure: non-malicious faults (indicated by patterns in the system resources usage), as well as effects of typical cyber-attacks directed to the smart grid infrastructure. The results show that the detection is promisingly fast and efficient.

A Review of Smart Grid Anomaly Detection Approaches Pertaining to Artificial Intelligence

“…Data integrity attacks [13,21,25,29,40,41,48,49,53,55,[59][60][61][62]70,75,76] Unusual consumption behaviors and measurements [6,24,27,32,34,35,38,46,52,67,68,[71][72][73] Network intrusions [16,18,19,56,63,69] Network infrastructure anomalies [14,15,17,20,22,33,39,47,58,64] Electrical data anomalies [7,23,26,36,…”

“…Monitoring CPU usage when it exceeds a predetermined threshold that could cause services to slow down, detecting RAM overload by setting a threshold on the maximum amount of usable memory, and keeping track of the number of concurrently active tasks on a machine can all support alerting of potentially compromised devices [64]. This type of monitoring has as input a large amount of log records generated by different heterogeneous devices connected in the network and could be improved by incorporating correlation and learning mechanisms.…”