Flexible Machine Learning-Based Cyberattack Detection Using Spatiotemporal Patterns for Distribution Systems

Cui, Mingjian; Wang, Jianhui; Chen, Bo

doi:10.1109/tsg.2020.2965797

Title: Flexible Machine Learning-Based Cyberattack Detection Using Spatiotemporal Patterns for Distribution Systems

Full Record
Other Related Research

Abstract

This letter develops a flexible machine learning detection method for cyberattacks in distribution systems considering spatiotemporal patterns. Spatiotemporal patterns are recognized by the graph Laplacian based on system-wide measurements. A flexible Bayes classifier (BC) is used to train spatiotemporal patterns which could be violated when cyberattacks occur. Cyberattacks are detected by using flexible BCs online. The effectiveness of the developed method is demonstrated through standard IEEE 13- and 123-node test feeders.

Authors:

^[1];

^[2]

Southern Methodist Univ., Dallas, TX (United States)
Argonne National Lab. (ANL), Argonne, IL (United States)

Publication Date:: 2020-03-01

Research Org.:: Argonne National Lab. (ANL), Argonne, IL (United States)

Sponsoring Org.:: USDOE Office of Cybersecurity, Energy Security, and Emergency Response (CESER)

OSTI Identifier:: 1812898

Grant/Contract Number:: AC02-06CH11357

Resource Type:: Accepted Manuscript

Journal Name:: IEEE Transactions on Smart Grid

Additional Journal Information:: Journal Volume: 11; Journal Issue: 2; Journal ID: ISSN 1949-3053

Publisher:: IEEE

Country of Publication:: United States

Language:: English

Subject:: 97 MATHEMATICS AND COMPUTING; Cyberattack detection; distribution systems; graph Laplacian; machine learning; spatiotemporal patterns

Citation Formats


                    Cui, Mingjian, Wang, Jianhui, and Chen, Bo. Flexible Machine Learning-Based Cyberattack Detection Using Spatiotemporal Patterns for Distribution Systems.  United States: N. p., 2020. 
Web.  doi:10.1109/tsg.2020.2965797.

Copy to clipboard


                    Cui, Mingjian, Wang, Jianhui, & Chen, Bo. Flexible Machine Learning-Based Cyberattack Detection Using Spatiotemporal Patterns for Distribution Systems.  United States.  https://doi.org/10.1109/tsg.2020.2965797

Copy to clipboard


                    Cui, Mingjian, Wang, Jianhui, and Chen, Bo. Sun .  
"Flexible Machine Learning-Based Cyberattack Detection Using Spatiotemporal Patterns for Distribution Systems".  United States.  https://doi.org/10.1109/tsg.2020.2965797.  https://www.osti.gov/servlets/purl/1812898.

Copy to clipboard


                    
@article{osti_1812898,

  title        = {Flexible Machine Learning-Based Cyberattack Detection Using Spatiotemporal Patterns for Distribution Systems},

  author       = {Cui, Mingjian and Wang, Jianhui and Chen, Bo},

  abstractNote = {This letter develops a flexible machine learning detection method for cyberattacks in distribution systems considering spatiotemporal patterns. Spatiotemporal patterns are recognized by the graph Laplacian based on system-wide measurements. A flexible Bayes classifier (BC) is used to train spatiotemporal patterns which could be violated when cyberattacks occur. Cyberattacks are detected by using flexible BCs online. The effectiveness of the developed method is demonstrated through standard IEEE 13- and 123-node test feeders.},

  doi          = {10.1109/tsg.2020.2965797},

  journal      = {IEEE Transactions on Smart Grid},

  number       = 2,

  volume       = 11,

  place        = {United States},

  year         = {2020},

  month        = {3}

}

Copy to clipboard

Journal Article:

Free Publicly Available Full Text

Accepted Manuscript (DOE)

Publisher's Version of Record

https://doi.org/10.1109/tsg.2020.2965797

Other availability

Search WorldCat to find libraries that may hold this journal

Save / Share:

Export Metadata

Save to My Library

Similar Records in DOE PAGES and OSTI.GOV collections:

Generalized Graph Laplacian Based Anomaly Detection for Spatiotemporal MicroPMU Data

Journal Article Cui, Mingjian ; Wang, Jianhui ; Florita, Anthony R. ; ... - IEEE Transactions on Power Systems

This letter develops a novel anomaly detection method using the generalized graph Laplacian (GGL) matrix to visualize the spatiotemporal relationship of distribution-level phasor measurement unit (uPMU) data. The uPMU data in a specific time horizon is segregated into multiple segments. An optimization problem formulated as a Lagrangian function is utilized to estimate the GGL matrix. During the iterative process, an optimal update is constituted as a quadratic program (QP) problem. To perform the uPMU-based spatiotemporal analysis, normalized diagonal elements of GGL matrix are proposed as a quantitative metric. The effectiveness of the developed method is demonstrated through real-world uPMU measurementsmore »« less
Cited by 14
https://doi.org/10.1109/TPWRS.2019.2917586

Full Text Available
Machine Learning-Based Anomaly Detection for Load Forecasting Under Cyberattacks

Journal Article Cui, Mingjian ; Wang, Jianhui ; Yue, Meng - IEEE Transactions on Smart Grid

Accurate load forecasting can create both economic and reliability benefits for power system operators. However, the cyberattack on load forecasting may mislead operators to make unsuitable operational decisions for the electricity delivery. To effectively and accurately detect these cyberattacks, this paper develops a machine learning-based anomaly detection (MLAD) methodology. First, load forecasts provided by neural networks are used to reconstruct the benchmark and scaling data by using the k-means clustering. Second, the cyberattack template is estimated by the naive Bayes classification based on the cumulative distribution function and statistical features of the scaling data. Finally, the dynamic programming is utilizedmore »« less
Cited by 55
https://doi.org/10.1109/TSG.2018.2890809

Full Text Available
Spatial-Temporal Deep Learning for Hosting Capacity Analysis in Distribution Grids

Journal Article Wu, Jiaqi ; Yuan, Jingyi ; Weng, Yang ; ... - IEEE Transactions on Smart Grid

The widespread use of distributed energy sources (DERs) raises significant challenges for power system design, planning, and operation, leading to wide adaptation of tools on hosting capacity analysis (HCA). Traditional HCA methods conduct extensive power flow analysis. Due to the computation burden, these time-consuming methods fail to provide online hosting capacity (HC) in large distribution systems. To solve the problem, we first propose a deep learning-based problem formulation for HCA, which conducts offline training and determines HC in real time. The used learning model, long short-term memory (LSTM), implements historical time-series data to capture periodical patterns in distribution systems. However,more »« less
https://doi.org/10.1109/TSG.2022.3196943
Predicting and Detecting Emerging Cyberattack Patterns Using StreamWorks

Conference Chin, George ; Choudhury, Sutanay ; Feo, John T. ; ...

The number and sophistication of cyberattacks on industries and governments have dramatically grown in recent years. To counter this movement, new advanced tools and techniques are needed to detect cyberattacks in their early stages such that defensive actions may be taken to avert or mitigate potential damage. From a cybersecurity analysis perspective, detecting cyberattacks may be cast as a problem of identifying patterns in computer network traffic. Logically and intuitively, these patterns may take on the form of a directed graph that conveys how an attack or intrusion propagates through the computers of a network. Such cyberattack graphs could providemore »« less
https://doi.org/10.1145/2602087.2602111
High performance FPGA embedded system for machine learning based tracking and trigger in sPhenix and EIC

Journal Article Xuan, T. ; Durao, F. ; Sun, Y. - Journal of Instrumentation

We present a comprehensive end-to-end pipeline to classify triggers versus background events in this paper. This pipeline makes online decisions to select signal data and enables the intelligent trigger system for efficient data collection in the Data Acquisition System (DAQ) of the upcoming sPHENIX and future EIC (Electron-Ion Collider) experiments. Starting from the coordinates of pixel hits that are lightened by passing particles in the detector, the pipeline applies three-stage of event processing (hits clustering, track reconstruction, and trigger detection) and labels all processed events with the binary tag of trigger versus background events. The pipeline consists of deterministic algorithmsmore »« less
https://doi.org/10.1088/1748-0221/17/07/c07003

Similar Records