A Novel Detection Algorithm to Identify False Data Injection Attacks on Power System State Estimation

Towards a Reference Architecture for Cargo Ports

Cyber-Physical Systems (CPS) are physical systems whose operations are coordinated, monitored, and controlled by computing and communication functions. These systems are typically heterogeneous, including Internet of Things and information technology subsystems, and can present a myriad of implementation details, making them very complex systems. An important type of CPS is a maritime container terminal (cargo port), which is a facility where cargo containers are transported between ships and land vehicles for onward transportation and vice versa. A cargo port performs four basic functions: receiving, storing, staging, and loading for both import and export containers. We present here process patterns that describe the functional aspects of cargo ports and a pattern that describes their structural properties (patterns are encapsulated solutions to recurrent problems). These patterns describe semantic aspects found in any cargo port and can be adapted to describe other CPSs. We decompose these process patterns into use cases that describe their interactions with the system. We then integrate the process patterns with structural patterns to assemble a partial reference architecture (RA) that shows the interactions of all the patterns while also indicating the typical stakeholders found in all ports. We validate the proposed reference architecture, highlighting its theoretical and practical value. Software and system designers of cargo ports need to start from a conceptual and abstract view that is subsequently refined to add more details. The use of reference architectures and patterns is an effective way to organize and describe the functional and non-functional aspects of a system, as well as to unify the design of all its aspects. This is, until now, the only published RA for cargo ports, and it can be a useful guideline for the designers of any type of cargo port.

Network Attack Detection Method of the Cyber-Physical Power System Based on Ensemble Learning

With the rapid development of power grid informatization, the power system has evolved into a multi-dimensional heterogeneous complex system with high cyber-physical integration, denoting the Cyber-Physical Power System (CPPS). Network attack, in addition to faults, becomes an important factor restricting the stable operation of the power system. Under the influence of network attacks, to improve the operational stability of CPPSs, this paper proposes a CPPS network attack detection method based on ensemble learning. First, to solve the shortcomings of a low detection precision caused by insufficient network attack samples, a power data balancing processing method was proposed. Then, the LightGBM ensemble was constructed to detect network attack events and lock the fault points caused by the attack. At the same time, in the process of gradient boost, the focal loss was introduced to optimize the attention weight of the classifier to the misclassified samples, thus improving the network attack detection precision. Finally, we propose an effective evaluation method of the network attack detection model based on cyber-physical comprehensive consideration. In addition, the cyber-physical power system stability under the action of the network attack detection model is quantitatively analyzed. The experimental results show that the F1 score of network attack detection increases by 16.73%, and the precision increases by 15.67%.

Enhancing Cybersecurity in Smart Grids: False Data Injection and Its Mitigation

Integration of information technologies with power systems has unlocked unprecedented opportunities in optimization and control fields. Increased data collection and monitoring enable control systems to have a better understanding of the pseudo-real-time condition of power systems. In this fashion, more accurate and effective decisions can be made. This is the key towards mitigating negative impacts of novel technologies such as renewables and electric vehicles and increasing their share in the overall generation portfolio. However, such extensive information exchange has created cybersecurity vulnerabilities in power systems that were not encountered before. It is imperative that these vulnerabilities are understood well, and proper mitigation techniques are implemented. This paper presents an extensive study of cybersecurity concerns in Smart grids in line with latest developments. Relevant standardization and mitigation efforts are discussed in detail and then the classification of different cyber-attacks in smart grid domain with special focus on false data injection (FDI) attack, due to its high impact on different operations. Different uses of this attack as well as developed detection models and methods are analysed. Finally, impacts on smart grid operation and current challenges are presented for future research directions.

The data dimensionality reduction and bad data detection in the process of smart grid reconstruction through machine learning

To detect false data injection attacks (FDIAs) in power grid reconstruction and solve the problem of high data dimension and bad abnormal data processing in the power system, thereby achieving safe and stable operation of the power grid system, this study introduces machine learning methods to explore the detection of FDIAs. First, through the utilization of the standard IEEE node system and the simulation of FDIAs under the condition of non-complete topology information, the construction of the attack data set is completed, and the MatPower tool is applied to simulate and analyze the data set. Second, based on the isolated Forest (iForest) abnormal score data processing algorithm combined with the Local Linear Embedding (LLE) data dimensionality reduction method, an algorithm for data feature extraction is constructed. Finally, based on the combination of the Convolutional Neural Network (CNN) and the Gated Recurrent Unit (GRU) network, an algorithm model for FDIAs detection is constructed. The results show that in the IEEE14-bus node and IEEE118-bus node systems, the overall distribution of the state estimated before and after the attack vector injection is consistent with the initial value. In the iFores algorithm, the number of iTree and the number of samples affect the extraction of abnormal score data. When the number of iTree n is determined to be 100, and the corresponding number of samples w is determined to be 10, the algorithm has the best detection effect. The FDIAs detection algorithm model based on CNN-GRU shows good detection effects under high attack intensity, with an accuracy rate of more than 95%, and its performance is better than other traditional detection algorithms. In this study, the bad data detection model based on deep learning has an active role in the realization of the safe and stable operation of the smart grid.

GridAttackSim: A Cyber Attack Simulation Framework for Smart Grids

The smart grid system is one of the key infrastructures required to sustain our future society. It is a complex system that comprises two independent parts: power grids and communication networks. There have been several cyber attacks on smart grid systems in recent years that have caused significant consequences. Therefore, cybersecurity training specific to the smart grid system is essential in order to handle these security issues adequately. Unfortunately, concepts related to automation, ICT, smart grids, and other physical sectors are typically not covered by conventional training and education methods. These cybersecurity experiences can be achieved by conducting training using a smart grid co-simulation, which is the integration of at least two simulation models. However, there has been little effort to research attack simulation tools for smart grids. In this research, we first review the existing research in the field, and then propose a smart grid attack co-simulation framework called GridAttackSim based on the combination of GridLAB-D, ns-3, and FNCS. The proposed architecture allows us to simulate smart grid infrastructure features with various cybersecurity attacks and then visualize their consequences automatically. Furthermore, the simulator not only features a set of built-in attack profiles but also enables scientists and electric utilities interested in improving smart grid security to design new ones. Case studies were conducted to validate the key functionalities of the proposed framework. The simulation results are supported by relevant works in the field, and the system can potentially be deployed for cybersecurity training and research.

Cost-Effective Placement of Phasor Measurement Units to Defend against False Data Injection Attacks on Power Grid

This study presents the phasor measurement unit (PMU) placement strategy in the presence of false data injection attacks which is one of the most serious security threats against power grid. It is focused on applications related to supervisory control and data acquisition (SCADA) systems where measurement data can be easily corrupted by adversaries without getting caught by the system. To safeguard power grids against malicious attacks, procedures have been proposed to facilitate the placement of secure PMUs to defend against false data injection attacks in a highly cost-effective way. It has formulated a method of identifying measurements that are vulnerable to false data injection attacks. It was discovered that a weak power grid can be transformed into a robust power grid by adding a few PMUs at vulnerable locations. Simulations on the IEEE standard test systems demonstrate the benefits of the proposed procedure.

Multi-layer intrusion detection system with ExtraTrees feature selection, extreme learning machine ensemble, and softmax aggregation

Recent advances in intrusion detection systems based on machine learning have indeed outperformed other techniques, but struggle with detecting multiple classes of attacks with high accuracy. We propose a method that works in three stages. First, the ExtraTrees classifier is used to select relevant features for each type of attack individually for each (ELM). Then, an ensemble of ELMs is used to detect each type of attack separately. Finally, the results of all ELMs are combined using a softmax layer to refine the results and increase the accuracy further. The intuition behind our system is that multi-class classification is quite difficult compared to binary classification. So, we divide the multi-class problem into multiple binary classifications. We test our method on the UNSW and KDDcup99 datasets. The results clearly show that our proposed method is able to outperform all the other methods, with a high margin. Our system is able to achieve 98.24% and 99.76% accuracy for multi-class classification on the UNSW and KDDcup99 datasets, respectively. Additionally, we use the weighted extreme learning machine to alleviate the problem of imbalance in classification of attacks, which further boosts performance. Lastly, we implement the ensemble of ELMs in parallel using GPUs to perform intrusion detection in real time.