Department of Electrical and Computer Engineering, University of Western Macedonia, 50100 Kozani, Greece.
0INF, Imperial Offices, London E6 2JG, UK.
Sensors (Basel). 2020 Sep 16;20(18):5305. doi: 10.3390/s20185305.
The advent of the Smart Grid (SG) raises severe cybersecurity risks that can lead to devastating consequences. In this paper, we present a novel anomaly-based Intrusion Detection System (IDS), called ARIES (smArt gRid Intrusion dEtection System), which is capable of protecting efficiently SG communications. ARIES combines three detection layers that are devoted to recognising possible cyberattacks and anomalies against (a) network flows, (b) Modbus/Transmission Control Protocol (TCP) packets and (c) operational data. Each detection layer relies on a Machine Learning (ML) model trained using data originating from a power plant. In particular, the first layer (network flow-based detection) performs a supervised multiclass classification, recognising Denial of Service (DoS), brute force attacks, port scanning attacks and bots. The second layer (packet-based detection) detects possible anomalies related to the Modbus packets, while the third layer (operational data based detection) monitors and identifies anomalies upon operational data (i.e., time series electricity measurements). By emphasising on the third layer, the ARIES Generative Adversarial Network (ARIES GAN) with novel error minimisation functions was developed, considering mainly the reconstruction difference. Moreover, a novel reformed conditional input was suggested, consisting of random noise and the signal features at any given time instance. Based on the evaluation analysis, the proposed GAN network overcomes the efficacy of conventional ML methods in terms of Accuracy and the F1 score.
智能电网 (SG) 的出现带来了严重的网络安全风险，可能导致灾难性的后果。在本文中，我们提出了一种新颖的基于异常的入侵检测系统 (IDS)，称为 ARIES (smArt gRid Intrusion dEtection System)，它能够有效地保护 SG 通信。ARIES 结合了三个检测层，致力于识别针对 (a) 网络流量、(b) Modbus/传输控制协议 (TCP) 数据包和 (c) 操作数据的可能的网络攻击和异常。每个检测层都依赖于使用源自发电厂的数据训练的机器学习 (ML) 模型。特别是，第一层（基于网络流量的检测）执行监督多类分类，识别拒绝服务 (DoS)、暴力攻击、端口扫描攻击和机器人。第二层（基于数据包的检测）检测与 Modbus 数据包相关的可能异常，而第三层（基于操作数据的检测）则监控和识别操作数据（即，时间序列电测量）上的异常。通过强调第三层，开发了具有新颖误差最小化函数的 ARIES 生成对抗网络 (ARIES GAN)，主要考虑重建差异。此外，还提出了一种新的改进条件输入，由随机噪声和任何给定时间点的信号特征组成。基于评估分析，所提出的 GAN 网络在准确性和 F1 分数方面优于传统的 ML 方法。
