Improving Cyber-Security of Smart Grid Systems via Anomaly Detection and Linguistic Domain Knowledge
The planned large scale deployment of smart grid network devices will generate a large amount of information exchanged over various types of communication networks. The implementation of these critical systems will require appropriate cyber-security measures. A network anomaly detection solution is considered in this work. In common network architectures multiple communications streams are simultaneously present, making it difficult to build an anomaly detection solution for the entire system. In addition, common anomaly detection algorithms require specification of a sensitivity threshold, which inevitably leads to a tradeoff between false positives and false negatives rates. In order to alleviate these issues, this paper proposes a novel anomaly detection architecture. The designed system applies the previously developed network security cyber-sensor method to individual selected communication streams allowing for learning accurate normal network behavior models. Furthermore, the developed system dynamically adjusts the sensitivity threshold of each anomaly detection algorithm based on domain knowledge about the specific network system. It is proposed to model this domain knowledge using Interval Type-2 Fuzzy Logic rules, which linguistically describe the relationship between various features of the network communication and the possibility of a cyber attack. The proposed method was tested on experimental smart grid system demonstrating enhanced cyber-security.
- Research Organization:
- Idaho National Lab. (INL), Idaho Falls, ID (United States)
- Sponsoring Organization:
- DOE - OE
- DOE Contract Number:
- DE-AC07-05ID14517
- OSTI ID:
- 1055968
- Report Number(s):
- INL/CON-12-25647
- Resource Relation:
- Conference: 5th International Symposium on Resilient Control Systems,Salt Lake City, UT,08/14/2012,08/16/2012
- Country of Publication:
- United States
- Language:
- English
Similar Records
Data-driven cyber attack detection and mitigation for decentralized wide-area protection and control in smart grids
Attack-resilient algorithms and testbed federation for wide-area protection and control in smart grid