Data Mining - Concepts and Techniques.

In this paper, we present a survey of deep learning approaches for cybersecurity intrusion detection, the datasets used, and a comparative study. Specifically, we provide a review of intrusion detection systems based on deep learning approaches. The dataset plays an important role in intrusion detection, therefore we describe 35 well-known cyber datasets and provide a classification of these datasets into seven categories; namely, network traffic-based dataset, electrical network-based dataset, internet traffic-based dataset, virtual private network-based dataset, android apps-based dataset, IoT traffic-based dataset, and internet-connected devices-based dataset. We analyze seven deep learning models including recurrent neural networks, deep neural networks, restricted Boltzmann machines, deep belief networks, convolutional neural networks, deep Boltzmann machines, and deep autoencoders. For each model, we study the performance in two categories of classification (binary and multiclass) under two new real traffic datasets, namely, the CSE-CIC-IDS2018 dataset and the Bot-IoT dataset. In addition, we use the most important performance indicators, namely, accuracy, false alarm rate, and detection rate for evaluating the efficiency of several methods.

/pdf/deep-learning-for-cyber-security-intrusion-detection-gwyxxf1kkj.pdf

Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study

Cyber-physical attacks are the main substantial threats facing the utilization and development of the various smart grid technologies. Among these attacks, false data injection attack represents a main category with its widely varied types and impacts that have been extensively reported recently. In addressing this threat, several detection algorithms have been developed in the last few years. These were either model-based or data-driven algorithms. This paper provides an intensive summary of these algorithms by categorizing them and elaborating on the pros and cons of each category. The paper starts by introducing the various cyber-physical attacks along with the main reported incidents in history. The significance and the impacts of the false data injection attacks are then reported. The concluding remarks present the main criteria that should be considered in developing future detection algorithms for the false data injection attacks.

A Survey on the Detection Algorithms for False Data Injection Attacks in Smart Grids

With increasing reliance on Internet of Things (IoT) devices and services, the capability to detect intrusions and malicious activities within IoT networks is critical for resilience of the network infrastructure. In this paper, we present a novel model for intrusion detection based on two-layer dimension reduction and two-tier classification module, designed to detect malicious activities such as User to Root (U2R) and Remote to Local (R2L) attacks. The proposed model is using component analysis and linear discriminate analysis of dimension reduction module to spate the high dimensional dataset to a lower one with lesser features. We then apply a two-tier classification module utilizing Naive Bayes and Certainty Factor version of K-Nearest Neighbor to identify suspicious behaviors. The experiment results using NSL-KDD dataset shows that our model outperforms previous models designed to detect U2R and R2L attacks.

/pdf/a-two-layer-dimension-reduction-and-two-tier-classification-4x8wrsx4te.pdf

A Two-Layer Dimension Reduction and Two-Tier Classification Model for Anomaly-Based Intrusion Detection in IoT Backbone Networks

The smart grid is arguably one of the most complex cyber-physical systems (CPS). Complex security challenges have been revealed in both the physical and the cyber parts of the smart grid, and an integrative analysis on the cyber-physical (CP) security is emerging. This paper provides a comprehensive and systematic review of the critical attack threats and defence strategies in the smart grid. We start this survey with an overview of the smart grid security from the CP perspective, and then focuses on prominent CP attack schemes with significant impact on the smart grid operation and corresponding defense solutions. With an in-depth review of the attacks and defences, we then discuss the opportunities and challenges along the smart grid CP security. We hope this paper raises awareness of the CP attack threats and defence strategies in complex CPS-based infrastructures such as the smart grid and inspires research effort toward the development of secure and resilient CP infrastructures.

Cyber-physical attacks and defences in the smart grid: a survey

Synchrophasor systems provide an immense volume of data for wide area monitoring and control of power systems to meet the increasing demand of reliable energy The construction of traditional intrusion detection systems (IDSs) that use manually created rules based upon expert knowledge is knowledge-intensive and is not suitable in the context of this big data problem This paper presents a systematic and automated approach to build a hybrid IDS that learns temporal state-based specifications for power system scenarios including disturbances, normal control operations, and cyber-attacks A data mining technique called common path mining is used to automatically and accurately learn patterns for scenarios from a fusion of synchrophasor measurement data, and power system audit logs As a proof of concept, an IDS prototype was implemented and validated The IDS prototype accurately classifies disturbances, normal control operations, and cyber-attacks for the distance protection scheme for a two-line three-bus power transmission system

Developing a Hybrid Intrusion Detection System Using Data Mining for Power Systems

Power system disturbances are inherently complex and can be attributed to a wide range of sources, including both natural and man-made events. Currently, the power system operators are heavily relied on to make decisions regarding the causes of experienced disturbances and the appropriate course of action as a response. In the case of cyber-attacks against a power system, human judgment is less certain since there is an overt attempt to disguise the attack and deceive the operators as to the true state of the system. To enable the human decision maker, we explore the viability of machine learning as a means for discriminating types of power system disturbances, and focus specifically on detecting cyber-attacks where deception is a core tenet of the event. We evaluate various machine learning methods as disturbance discriminators and discuss the practical implications for deploying machine learning systems as an enhancement to existing power system architectures.

Machine learning for power system disturbance and cyber-attack discrimination

This paper addresses the attack modeling using vulnerability of information, communication and electric grid network. Vulnerability of electric grid with incomplete information has been analyzed using graph theory based approach. Vulnerability of information and communication (cyber) network has been modeled utilizing concepts of discovery, access, feasibility, communication speed and detection threat. Common attack vector based on vulnerability of cyber and physical system have been utilized to operate breakers associated with generating resources to model aurora-like event. Real time simulations for modified IEEE 14 bus test case system and graph theory analysis for IEEE 118 bus system have been presented. Test case results show the possible impact on smart grid caused by integrated cyber-physical attack.

Modeling Cyber-Physical Vulnerability of the Smart Grid With Incomplete Information

Visualization and situational awareness are of vital importance for power systems, as the earlier a power-system event such as a transmission line fault or cyber-attack is identified, the quicker operators can react to avoid unnecessary loss. Accurate time-synchronized data, such as system measurements and device status, provide benefits for system state monitoring. However, the time-domain analysis of such heterogeneous data to extract patterns is difficult due to the existence of transient phenomena in the analyzed measurement waveforms. This paper proposes a sequential pattern mining approach to accurately extract patterns of power-system disturbances and cyber-attacks from heterogeneous time-synchronized data, including synchrophasor measurements, relay logs, and network event monitor logs. The term common path is introduced. A common path is a sequence of critical system states in temporal order that represent individual types of disturbances and cyber-attacks. Common paths are unique signatures for each observed event type. They can be compared to observed system states for classification. In this paper, the process of automatically discovering common paths from labeled data logs is introduced. An included case study uses the common path-mining algorithm to learn common paths from a fusion of heterogeneous synchrophasor data and system logs for three types of disturbances (in terms of faults) and three types of cyber-attacks, which are similar to or mimic faults. The case study demonstrates the algorithm’s effectiveness at identifying unique paths for each type of event and the accompanying classifier’s ability to accurately discern each type of event.

Classification of Disturbances and Cyber-Attacks in Power Systems Using Heterogeneous Time-Synchronized Data

Researchers from various cross disciplinary fields such as power systems, data science, and cybersecurity face two distinct challenges. First, the lack of a comprehensive test bed that integrates industry standard hardware, software, and wide area measurement system (WAMS) components and protocols impedes the study of cybersecurity issues including vulnerabilities associated with WAMS components and the consequences of exploitation of vulnerabilities. Second, a lack of comprehensive labeled Synchrophasor data along with other system related information imposes challenges to the development and evaluation of data mining algorithms that can classify power system cyber-power events. In this paper, a WAMS cyber-physical test bed was developed using a real time digital simulator with hardware-in-the-loop simulation. Commercial control and monitoring devices, hardware, software, and industry standard communication networks and protocols were combined with custom MATLAB, Python, and AutoIt scripts to model realistic power system contingencies and cyber-attacks. An automated simulation and control engine was developed to randomize modeled cyber-power events including power system faults, contingencies, control actions, and cyber-attacks. Scripts were added to capture heterogenous sensor data and create ground truth labeled datasets. The WAMS cyber-physical test bed is capable of simulating various sized power systems and creating datasets without altering the hardware configuration. A WAMS architecture is presented to document the integration of various components. Finally, test bed applications, simulated cyber-power scenarios, the dataset development process, and selected results are presented.

Uttam Adhikari

Papers

Developing a Hybrid Intrusion Detection System Using Data Mining for Power Systems

Machine learning for power system disturbance and cyber-attack discrimination

Modeling Cyber-Physical Vulnerability of the Smart Grid With Incomplete Information

Classification of Disturbances and Cyber-Attacks in Power Systems Using Heterogeneous Time-Synchronized Data

WAMS Cyber-Physical Test Bed for Power System, Cybersecurity Study, and Data Mining