Developing a Hybrid Intrusion Detection System Using Data Mining for Power Systems
IEEE Transactions on Smart GridPublished 18 March 2015
Shengyi Pan, Thomas H. Morris, Uttam Adhikari
Citations443
SJR quartileQ1
SJR score4.61
SNIP3.02
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
A systematic and automated approach to build a hybrid IDS that learns temporal state-based specifications for power system scenarios including disturbances, normal control operations, and cyber-attacks is presented.
Abstract
Synchrophasor systems provide an immense volume of data for wide area monitoring and control of power systems to meet the increasing demand of reliable energy. The construction of traditional intrusion detection systems (IDSs) that use manually created rules based upon expert knowledge is knowledge-intensive and is not suitable in the context of this big data problem. This paper presents a systematic and automated approach to build a hybrid IDS that learns temporal state-based specifications for power system scenarios including disturbances, normal control operations, and cyber-attacks. A data mining technique called common path mining is used to automatically and accurately learn patterns for scenarios from a fusion of synchrophasor measurement data, and power system audit logs. As a proof of concept, an IDS prototype was implemented and validated. The IDS prototype accurately classifies disturbances, normal control operations, and cyber-attacks for the distance protection scheme for a two-line three-bus power transmission system.
Keywords
Computer Science
Choice Reviews OnlineData mining: concepts and techniques
28,877 Citations2012Jiawei Han, Micheline Kamber +1 more
Data mining is the search for new, valuable, and nontrivial information in large volumes of data, a cooperative effort of humans and computers that is possible to put data-mining activities into one of two categories: Predictive data mining, which produces the model of the system described by the given data set, or Descriptive data mining which produces new, nontrivials information based on the available data set.
Mining sequential patterns
5,115 Citations2002R. K. Agrawal, Ramakrishnan Srikant
Three algorithms are presented to solve the problem of mining sequential patterns over databases of customer transactions, and empirically evaluating their performance using synthetic data shows that two of them have comparable performance.
A data mining framework for building intrusion detection models
1,160 Citations2003Wenke Lee, Salvatore J. Stolfo +1 more
A data mining framework for adaptively building Intrusion Detection (ID) models is described, to utilize auditing programs to extract an extensive set of features that describe each network connection or host session, and apply data mining programs to learn rules that accurately capture the behavior of intrusions and normal activities.
CERN Document Server (European Organization for Nuclear Research)Power system analysis
818 Citations1999Hadi Saadat
IEEE Transactions on Smart GridDistributed Intrusion Detection System in a Multi-Layer Network Architecture of Smart Grids
438 Citations2011Yichi Zhang, Lingfeng Wang +3 more
Simulation results demonstrate that this is a promising methodology for supporting the optimal communication routing and improving system security through the identification of malicious network traffic.
Machine learning for power system disturbance and cyber-attack discrimination
300 Citations2014Raymond Borges Hink, Justin M. Beaver +4 more
This work explores the viability of machine learning as a means for discriminating types of power system disturbances, and focuses specifically on detecting cyber-attacks where deception is a core tenet of the event.
IEEE Transactions on Smart GridAnomaly Detection for Cybersecurity of the Substations
269 Citations2011Chee‐Wooi Ten, Junho Hong +1 more
An anomaly inference algorithm is proposed for early detection of cyber-intrusions at the substations using the modified IEEE 118-bus system and results have shown the effectiveness of the proposed method for systematic identification.
Specification-Based Intrusion Detection for Advanced Metering Infrastructures
185 Citations2011Robin Berthier, William H. Sanders
A specification-based intrusion detection sensor that can be deployed in the field to identify security threats in real time is introduced that monitors the traffic among meters and access points at the network, transport, and application layers to ensure that devices are running in a secure state and their operations respect a specified security policy.
IEEE Transactions on Smart GridBehavior-Rule Based Intrusion Detection Systems for Safety Critical Smart Grid Applications
184 Citations2013Robert Mitchell, Ing-Ray Chen
It is shown that BRIDS outperforms contemporary anomaly-based IDSs via comparative analysis and can effectively trade false positives for a high detection probability to cope with sophisticated and hidden attackers to support ultra safe and secure applications.
IEEE Transactions on Power SystemsReal-time intrusion detection in power system operations
181 Citations2012Jorge Valenzuela, Jianhui Wang +1 more
An algorithm is developed that monitors power flow results and detects anomalies in the input values that could have been modified by cyberattacks, and is a promising enhancement to data security procedures in a control center.
Leveraging determinism in industrial control systems for advanced anomaly detection and reliable security configuration
62 Citations2009Hadeli Hadeli, Ragnar Schierholz +2 more
Common IDS technology is extended to also detect an IACS specific anomaly: the missing of required traffic, to reliably detect anomalies and reproducibly generate configurations for security mechanisms such as firewalls.
Abstraction-based misuse detection: high-level specifications and adaptable strategies
56 Citations2002Jia‐Ling Lin, X.S. Wang +1 more
A high level language for abstract misuse signatures (MuSigs) can represent misuses in a simple form and yet with high expressiveness and the adaptability of the system is obtained by the ability for the site security officer to add or delete system directives to change the behavior of the monitoring program.
Intrusion detection system for network security in synchrophasor systems
55 Citations2013Ye Yang, Hong Wang +5 more
The paper investigates and simulates reconnaissance, Man-in-the-Middle (MITM) and Denial-of-Service (DoS) attacks against a practical synchrophasor system that is used to validate the effectiveness of the proposed SSIDS detection tool.
S2A
32 Citations2012Yuxin Chen, Bo Luo
S2A, a security protection solution to be embedded in smart appliances, is presented and Evaluation shows that S2A ensures appliances security while providing good usability and economical efficiency.
IEEE Transactions on Power SystemsCollaborative, Trust-Based Security Mechanisms for a Regional Utility Intranet
27 Citations2008G.M. Coates, Kenneth M. Hopkinson +2 more
This paper investigates network policies and mechanisms to enhance security in SCADA networks using a mix of TCP and UDP transport protocols over IP and recommends creating a trust system that can be added in strategic locations to protect existing legacy architectures and to accommodate a transition to IP.
Collaborative, trust-based security mechanisms for a regional utility intranet
21 Citations2009G.M. Coates, Kenneth M. Hopkinson +2 more
Zenodo (CERN European Organization for Nuclear Research)Secure Power Systems Against Malicious Cyber-Physical Data Attacks: Protection And Identification
17 Citations2012Morteza Talebi Doluee, Jianan Wang +1 more
An algebraic condition for trustworthy power system to evade malicious data injection is defined and the proposed protection scheme secures the power system by deterministically reconfiguring the information structure and corresponding residual test.
International Journal of Electrical Power & Energy SystemsAn integrated lookahead control-based adaptive supervisory framework for autonomic power system applications
14 Citations2014Ranjit Amgai, Jian Shi +1 more
The formulation of a generic, higher layer model-based Limited Lookahead Control (LLC) approach that can be applied to a variety of power system applications and a case studies on Matlab, and RTDS® to demonstrate the applicability of the proposed framework.
Using Bayesian networks for discovering temporal-state transition patterns in Hemodialysis
14 Citations2003Fu‐ren Lin, Chih-hung Chiu +1 more
This paper adopts Bayesian networks for discovering temporal-state transition patterns in the Hemodialysis process, a graphical model that encodes probabilistic relationships among variables and easily incorporates new instances to maintain rules up to date.