Skip to main content
SpringerLink
Log in

Semi-supervised Deep Learning-Driven Anomaly Detection Schemes for Cyber-Attack Detection in Smart Grids

  • Chapter
  • First Online:
Power Systems Cybersecurity

Part of the book series: Power Systems ((POWSYS))

Abstract

Modern power systems are continuously exposed to malicious cyber-attacks. Analyzing industrial control system (ICS) traffic data plays a central role in detecting and defending against cyber-attacks. Detection approaches based on system modeling require effectively modeling the complex behavior of the critical infrastructures, which remains a challenge, especially for large-scale systems. Alternatively, data-driven approaches which rely on data collected from the inspected system have become appealing due to the availability of big data that supports machine learning methods to achieve outstanding performance. This chapter presents an enhanced cyber-attack detection strategy using unlabeled data for ICS traffic monitoring and detecting suspicious data transmissions. Importantly, we designed two semi-supervised hybrid deep learning-based anomaly detection methods for intrusion detection in ICS traffic of smart grid. The first approach is a Gated recurrent unit (GRU)-based stacked autoencoder (AE-GRU), and the second is constructed using a generative adversarial network (GAN) model with a recurrent neural network (RNN) for both generator and discriminator that we called GAN-RNN. The employment of GRU and RNN in AE and GAN models is expected to improve the ability of these models to learn the temporal dependencies of multivariate data. These models are used for feature extraction and anomaly detection methods (Isolation forest, Local outlier factor, One-Class SVM, and Elliptical Envelope) for cyber-attack in power systems. These approaches only employ normal events data for training without labeled attack types, making them more attractive for detecting cyber-attack in practice. The detection performance of these approaches is demonstrated on IEC 60870-5-104 (aka IEC 104) control communication that is often utilized for substation control in smart grids. Results showed that GAN-GRU and AE-GRU-based LOF methods achieved enhanced detection with an averaged F1-score of 0.98, among others.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 149.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 199.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info
Hardcover Book
USD 199.99
Price excludes VAT (USA)
  • Durable hardcover edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Similar content being viewed by others

References

  1. W. Wang, Z. Lu, Cyber security in the smart grid: survey and challenges. Comput. Netw. 57(5), 1344–1371 (2013)

    Article  Google Scholar 

  2. M.Z. Gunduz, R. Das, Cyber-security on smart grid: threats and potential solutions. Comput. Netw. 169, 107094 (2020)

    Article  Google Scholar 

  3. R. Leszczyna, A review of standards with cybersecurity requirements for smart grid. Comput. Secur. 77, 262–276 (2018)

    Article  Google Scholar 

  4. R.K. Pandey, M. Misra, Cyber security threats-smart grid infrastructure, in National Power Systems Conference (NPSC), vol. 2016 (IEEE, 2016), pp. 1–6

    Google Scholar 

  5. A. Teymouri, A. Mehrizi-Sani, C.-C. Liu, Cyber security risk assessment of solar pv units with reactive power capability, in IECON 2018-44th Annual Conference of the IEEE Industrial Electronics Society (IEEE, 2018), pp. 2872–2877

    Google Scholar 

  6. W. Wang, F. Harrou, B. Bouyeddou, S.-M. Senouci, Y. Sun, A stacked deep learning approach to cyber-attacks detection in industrial systems: application to power system and gas pipeline systems. Clust. Comput. 25(1), 561–578 (2022)

    Article  Google Scholar 

  7. M. Stănculescu, S. Deleanu, P.C. Andrei, H. Andrei, A case study of an industrial power plant under cyberattack: simulation and analysis. Energies 14(9), 2568 (2021)

    Article  Google Scholar 

  8. A.A.Z. Khan, G. Serpen, Intrusion detection and identification system design and performance evaluation for industrial scada networks (2020), arXiv preprint arXiv:2012.09707

  9. J.R. Vacca, Cyber Security and IT Infrastructure Protection. Syngress (2013)

    Google Scholar 

  10. M. Touhiduzzaman, S.N.G. Gourisetti, C. Eppinger, A. Somani, A review of cybersecurity risk and consequences for critical infrastructure. 2019 Resilience Week (RWS) 1, 7–13 (2019)

    Google Scholar 

  11. J. Jiang, X. Zhao, S. Wallace, E. Cotilla-Sanchez, R. Bass, Mining pmu data streams to improve electric power system resilience, in Proceedings of the Fourth IEEE/ACM International Conference on Big Data Computing, Applications and Technologies (2017), pp. 95–102

    Google Scholar 

  12. C. Konstantinou, M. Sazos, M. Maniatakos, Attacking the smart grid using public information, in 17th Latin-American Test Symposium (LATS), vol. 2016. (IEEE, 2016), pp. 105–110

    Google Scholar 

  13. S. Basumallik, R. Ma, S. Eftekharnejad, Packet-data anomaly detection in pmu-based state estimator using convolutional neural network. Int. J. Electrical Power Energy Syst. 107, 690–702 (2019)

    Article  Google Scholar 

  14. W. Wang, F. Harrou, B. Bouyeddou, S.-M. Senouci, Y. Sun, Cyber-attacks detection in industrial systems using artificial intelligence-driven methods. Int. J. Critic. Infrastruct. Protect. 100542 (2022)

    Google Scholar 

  15. A. Walker, J. Desai, D. Saleem, T. Gunda, Cybersecurity in Photovoltaic Plant Operations, National Renewable Energy Lab (NREL), Golden, CO (United States), Technical Report, 2021)

    Book  Google Scholar 

  16. J. Ye, A. Giani, A. Elasser, S.K. Mazumder, C. Farnell, H.A. Mantooth, T. Kim, J. Liu, B. Chen, G.-S. Seo et al., A review of cyber-physical security for photovoltaic systems (IEEE J. Emerg. Select, Topics Power Electron, 2021)

    Google Scholar 

  17. C.-C. Sun, A. Hahn, C.-C. Liu, Cyber security of a power grid: state-of-the-art. Int. J. Electr. Power Energy Syst. 99, 45–56 (2018)

    Article  Google Scholar 

  18. Z. El Mrabet, N. Kaabouch, H. El Ghazi, H. El Ghazi, Cyber-security in smart grid: survey and challenges. Comput. Electr. Eng. 67, 469–482 (2018)

    Article  Google Scholar 

  19. F. Nejabatkhah, Y.W. Li, H. Liang, and R. Reza Ahrabi, Cyber-security of smart microgrids: a survey. Energies 14(1), 27 (2020)

    Google Scholar 

  20. Y. Zhang, L. Wang, Z. Liu, W. Wei, A cyber-insurance scheme for water distribution systems considering malicious cyberattacks. IEEE Trans. Inf. Forens. Secur. 16, 1855–1867 (2020)

    Article  Google Scholar 

  21. A. Giani, E. Bitar, M. Garcia, M. McQueen, P. Khargonekar, K. Poolla, Smart grid data integrity attacks: characterizations and countermeasures \(\pi \), in 2011 IEEE International Conference on Smart Grid Communications (SmartGridComm) (IEEE, 2011), pp. 232–237

    Google Scholar 

  22. D. An, Q. Yang, W. Liu, Y. Zhang, Defending against data integrity attacks in smart grid: A deep reinforcement learning-based approach. IEEE Access 7, 110 835–110 845 (2019)

    Google Scholar 

  23. P. Srikantha, D. Kundur, Denial of service attacks and mitigation for stability in cyber-enabled power grid, in IEEE Power and Energy Society Innovative Smart Grid Technologies Conference (ISGT), vol. 2015 (IEEE, 2015), pp. 1–5

    Google Scholar 

  24. M.Z. Gunduz, R. Das, Analysis of cyber-attacks on smart grid applications, in 2018 International Conference on Artificial Intelligence and Data Processing (IDAP) (IEEE, 2018), pp. 1–5

    Google Scholar 

  25. A. Huseinovic, S. Mrdovic, K. Bicakci, S. Uludag, A taxonomy of the emerging denial-of-service attacks in the smart grid and countermeasures, in 26th Telecommunications Forum (TELFOR), vol. 2018 (IEEE, 2018), pp. 1–4

    Google Scholar 

  26. Z. Lu, X. Lu, W. Wang, C. Wang, Review and evaluation of security threats on the communication networks in the smart grid, in 2010-Milcom, Military Communications Conference, vol. 2010 (IEEE, 2010), pp. 1830–1835

    Google Scholar 

  27. S.A. Yadav, S.R. Kumar, S. Sharma, A. Singh, A review of possibilities and solutions of cyber attacks in smart grids, in 2016 International Conference on Innovation and Challenges in Cyber Security (ICICCS-INBUSH) (IEEE, 2016), pp. 60–63

    Google Scholar 

  28. M. Caselli, E. Zambon, F. Kargl, Sequence-aware intrusion detection in industrial control systems, in Proceedings of the 1st ACM Workshop on Cyber-Physical System Security (2015), pp. 13–24

    Google Scholar 

  29. H. Yoo, T. Shon, Novel approach for detecting network anomalies for substation automation based on iec 61850. Multimedia Tools Appl. 74(1), 303–318 (2015)

    Article  Google Scholar 

  30. P. Maynard, K. McLaughlin, B. Haberler, Towards understanding man-in-the-middle attacks on iec 60870-5-104 scada networks, in 2nd International Symposium for ICS and SCADA Cyber Security Research 2014 (ICS-CSR 2014) 2 (2014), pp. 30–42

    Google Scholar 

  31. P. Matoušek, O. Ryšavỳ, M. Grégr, V. Havlena, Flow based monitoring of ics communication in the smart grid. J. Inf. Secur. Appl. 54, 102535 (2020)

    Google Scholar 

  32. J. Jarmakiewicz, K. Parobczak, K. Maślanka, Cybersecurity protection for power grid control infrastructures. Int. J. Crit. Infrastruct. Prot. 18, 20–33 (2017)

    Article  Google Scholar 

  33. J. Hong, C.-C. Liu, M. Govindarasu, Integrated anomaly detection for cyber security of the substations. IEEE Trans. Smart Grid 5(4), 1643–1653 (2014)

    Article  Google Scholar 

  34. A. Valdes, S. Cheung, “Communication pattern anomaly detection in process control systems, in 2009 IEEE Conference on Technologies for Homeland Security (IEEE, 2009), pp. 22–29

    Google Scholar 

  35. Y. Yang, K. McLaughlin, T. Littler, S. Sezer, B. Pranggono, H. Wang, Intrusion detection system for iec 60870-5-104 based scada networks, in IEEE Power and Energy Society General Meeting, vol. 2013 (IEEE, 2013), 1–5

    Google Scholar 

  36. C.-Y. Lin, S. Nadjm-Tehrani, Understanding iec-60870-5-104 traffic patterns in scada networks, in Proceedings of the 4th ACM Workshop on Cyber-Physical System Security (2018), pp. 51–60

    Google Scholar 

  37. A. Kleinmann, A. Wool, Automatic construction of statechart-based anomaly detection models for multi-threaded scada via spectral analysis, in Proceedings of the 2nd ACM Workshop on Cyber-Physical Systems Security and Privacy (2016), pp. 1–12

    Google Scholar 

  38. S. Shukla, S. Thakur, J.G. Breslin, Anomaly detection in smart grid network using fc-based blockchain model and linear svm, in International Conference on Machine Learning, Optimization, and Data Science (Springer, 2021), pp. 157–171

    Google Scholar 

  39. F. Harrou, Y. Sun, A.S. Hering, M. Madakyaru, A. Dairi, Unsupervised deep learning-based process monitoring methods, in Statistical Process Monitoring Using Advanced Data-Driven and Deep Learning Approaches (Elsevier, 2021), pp. 193–223

    Google Scholar 

  40. A. Dairi, F. Harrou, Y. Sun, M. Senouci, Obstacle detection for intelligent transportation systems using deep stacked autoencoder and \(k\)-nearest neighbor scheme. IEEE Sens. J. 18(12), 5122–5132 (2018)

    Article  Google Scholar 

  41. A. Dairi, F. Harrou, M. Senouci, Y. Sun, Unsupervised obstacle detection in driving environments using deep-learning-based stereovision. Robot. Auton. Syst. 100, 287–301 (2018)

    Article  Google Scholar 

  42. D. Charte, F. Charte, S. García, M.J. del Jesus, F. Herrera, A practical tutorial on autoencoders for nonlinear feature fusion: taxonomy, models, software and guidelines. Inf. Fus. 44, 78–96 (2018)

    Article  Google Scholar 

  43. S. Hochreiter, J. Schmidhuber, Long short-term memory. Neural Comput. 9(8), 1735–1780 (1997)

    Article  Google Scholar 

  44. F. Harrou, F. Kadri, Y. Sun, Forecasting of photovoltaic solar power production using lstm approach, in Advanced Statistical Modeling, Forecasting, and Fault Detection in Renewable Energy Systems (2020), p. 3

    Google Scholar 

  45. A. Zeroual, F. Harrou, A. Dairi, Y. Sun, Deep learning methods for forecasting covid-19 time-series data: a comparative study. Chaos, Solitons Fractals 140, 110121 (2020)

    Article  MathSciNet  Google Scholar 

  46. A. Creswell, T. White, V. Dumoulin, K. Arulkumaran, B. Sengupta, A.A. Bharath, Generative adversarial networks: an overview. IEEE Signal Process. Mag. 35(1), 53–65 (2018)

    Article  Google Scholar 

  47. L. Zhu, Y. Chen, P. Ghamisi, J.A. Benediktsson, Generative adversarial networks for hyperspectral image classification. IEEE Trans. Geosci. Remote Sens. 56(9), 5046–5063 (2018)

    Article  Google Scholar 

  48. I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, Y. Bengio, Generative adversarial networks. Commun. ACM 63(11), 139–144 (2020)

    Article  MathSciNet  Google Scholar 

  49. F. Kadri, A. Dairi, F. Harrou, Y. Sun, Towards accurate prediction of patient length of stay at emergency department: a gan-driven deep learning framework. J. Ambient Intell. Human. Comput. 1–15 (2022)

    Google Scholar 

  50. R.R.R. Barbosa, R. Sadre, A. Pras, Towards periodicity based anomaly detection in scada networks, in Proceedings of 2012 IEEE 17th International Conference on Emerging Technologies and Factory Automation (ETFA 2012) (IEEE, 2012), pp. 1–4

    Google Scholar 

  51. H.J. Shin, D.-H. Eom, S.-S. Kim, One-class support vector machines-an application in machine fault detection and classification. Comput. Ind. Eng. 48(2), 395–408 (2005)

    Article  Google Scholar 

  52. F. Harrou, N. Zerrouki, A. Dairi, Y. Sun, A. Houacine, Automatic human fall detection using multiple tri-axial accelerometers, in 2021 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies (3ICT) (2021), pp. 74–78

    Google Scholar 

  53. B. Schölkopf, J.C. Platt, J. Shawe-Taylor, A.J. Smola, R.C. Williamson, Estimating the support of a high-dimensional distribution. Neural Comput. 13(7), 1443–1471 (2001)

    Article  MATH  Google Scholar 

  54. F. Harrou, N. Zerrouki, A. Dairi, Y. Sun, A. Houacine, Automatic human fall detection using multiple tri-axial accelerometers, in 2021 International Conference on Innovation and Intelligence for Informatics, Computing, and Technologies (3ICT) (IEEE, 2021), pp. 74–78

    Google Scholar 

  55. A. Dairi, F. Harrou, Y. Sun, Deep generative learning-based 1-svm detectors for unsupervised covid-19 infection detection using blood tests. IEEE Trans. Instrum. Meas. 71, 1–11 (2021)

    Article  Google Scholar 

  56. F. Harrou, A. Dairi, B. Taghezouit, Y. Sun, An unsupervised monitoring procedure for detecting anomalies in photovoltaic systems using a one-class support vector machine. Sol. Energy 179, 48–58 (2019)

    Article  Google Scholar 

  57. F.T. Liu, K.M. Ting, Z.-H. Zhou, Isolation forest, in Eighth IEEE International Conference on Data Mining, vol. 2008 (IEEE, 2008), pp. 413–422

    Google Scholar 

  58. F.T. Liu, K.M. Ting, Z.-H. Zhou, Isolation-based anomaly detection. ACM Trans. Knowl. Discov. Data (TKDD) 6(1), 1–39 (2012)

    Article  Google Scholar 

  59. L. Breiman, Random forests. Mach. Learn. 45(1), 5–32 (2001)

    Article  MATH  Google Scholar 

  60. P.J. Rousseeuw, K.V. Driessen, A fast algorithm for the minimum covariance determinant estimator. Technometrics 41(3), 212–223 (1999)

    Article  Google Scholar 

  61. M.M. Breunig, H.-P. Kriegel, R.T. Ng, J. Sander, Lof: identifying density-based local outliers,” in Proceedings of the 2000 ACM SIGMOD International Conference on Management of Data (2000), pp. 93–104

    Google Scholar 

  62. C.-Y. Lin, S. Nadjm-Tehrani, A comparative analysis of emulated and real iec-104 spontaneous traffic in power system networks, in International Workshop on Cyber-Physical Security for Critical Infrastructures Protection (Springer, 2020), pp. 207–223

    Google Scholar 

  63. G. Clarke, D. Reynders, E. Wright, Practical modern SCADA protocols: DNP3, 60870.5 and related systems. Newnes (2004)

    Google Scholar 

  64. F. Harrou, B. Khaldi, Y. Sun, F. Cherif, An efficient statistical strategy to monitor a robot swarm. IEEE Sens. J. 20(4), 2214–2223 (2019)

    Article  Google Scholar 

  65. D.M. Powers, Evaluation: from precision, recall and f-measure to roc, informedness, markedness and correlation (2020), arXiv preprint arXiv:2010.16061

  66. P. Matoušek, O. Ryšavý, P. Grofčík, ICS dataset for smart grid anomaly detection (2022). https://dx.doi.org/10.21227/1trw-n685

  67. P. Matoušek, V. Havlena, L. Holík, Efficient modelling of ics communication for anomaly detection using probabilistic automata, in IFIP/IEEE International Symposium on Integrated Network Management (IM), vol. 2021 (IEEE, 2021), pp. 81–89

    Google Scholar 

  68. A. Dairi, F. Harrou, Y. Sun, S. Khadraoui, Short-term forecasting of photovoltaic solar power production using variational auto-encoder driven deep learning approach. Appl. Sci. 10(23), 8400 (2020)

    Article  Google Scholar 

  69. F. Harrou, Y. Sun, A.S. Hering, M. Madakyaru et al., Statistical Process Monitoring Using Advanced Data-Driven and Deep Learning Approaches: Theory and Practical Applications (Elsevier, 2020)

    Google Scholar 

Download references

Acknowledgements

This publication is based upon work supported by King Abdullah University of Science and Technology (KAUST), Office of Sponsored Research (OSR) under Award No: OSR-2019-CRG7-3800.

Author information

Authors and Affiliations

  1. Computer Science Department, University of Science and Technology of Oran-Mohamed Boudiaf (USTO-MB), El Mnaouar, BP 1505, Bir El Djir, 31000, Algeria

    Abdelkader Dairi

  2. CEMSE Division, King Abdullah University of Science and Technology (KAUST), Thuwal, 23955-6900, Saudi Arabia

    Fouzi Harrou & Ying Sun

  3. STIC Lab, Department of Telecommunications, Abou Bekr Belkaid University, Tlemcen, Algeria

    Benamar Bouyeddou

  4. LESM Lab., Department of Electronics, Faculty of Technology, University of Saida-Dr Moulay Tahar, Saida, Algeria

    Benamar Bouyeddou

  5. DRIVE Laboratory, University of Burgundy, Nevers, France

    Sidi-Mohammed Senouci

Authors
  1. Abdelkader Dairi
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Fouzi Harrou
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Benamar Bouyeddou
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Sidi-Mohammed Senouci
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Ying Sun
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Fouzi Harrou .

Editor information

Editors and Affiliations

  1. Department of Electrical and Computer Systems Engineering, Monash University, Clayton, VIC, Australia

    Hassan Haes Alhelou

  2. Department of Electrical and Computer Engineering, National Technical University of Athens, Athens, Greece

    Nikos Hatziargyriou

  3. School of Electrical and Electronics Engineering, Nanyang Technological University, Singapore, Singapore

    Zhao Yang Dong

Rights and permissions

Reprints and permissions

Copyright information

© 2023 The Author(s), under exclusive license to Springer Nature Switzerland AG

About this chapter

Check for updates. Verify currency and authenticity via CrossMark

Cite this chapter

Dairi, A., Harrou, F., Bouyeddou, B., Senouci, SM., Sun, Y. (2023). Semi-supervised Deep Learning-Driven Anomaly Detection Schemes for Cyber-Attack Detection in Smart Grids. In: Haes Alhelou, H., Hatziargyriou, N., Dong, Z.Y. (eds) Power Systems Cybersecurity. Power Systems. Springer, Cham. https://doi.org/10.1007/978-3-031-20360-2_11

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-20360-2_11

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-20359-6

  • Online ISBN: 978-3-031-20360-2

  • eBook Packages: EnergyEnergy (R0)

Publish with us

Policies and ethics

Search

Navigation