Anomaly detection in digital substations using semi-supervised learning
Tóm tắt: 97
| 
PDF: 83 
##plugins.themes.academic_pro.article.main##
Author
Từ khóa:
Tóm tắt
The integration of Information and Communication Technology (ICT) into Operational Technology (OT) environments in modern substations has heightened cybersecurity risks. Effective Intrusion Detection Systems (IDS) are essential, yet current supervised learning methods struggle due to the scarcity and unreliability of labeled attack data. To address this, we propose a Semi-Supervised Anomaly Detection (SSAD) approach that leverages partially labeled datasets, where normal samples are labeled but anomalies are sparse or unlabeled. SSAD provides flexibility and efficiency in real-time detection, making it particularly suitable for digital substations and IEC104 network traffic. Our method enables reliable intrusion detection without requiring extensive labeled anomaly data, offering a practical solution to enhance both security and resilience.
Tài liệu tham khảo
-
[1] P. Blazek, A. Bohacik, R. Fujdiak, V. Jurak, and M. Ptacek, “Smart Grids Transmission Network Testbed: Design, Deployment, and Beyond”, IEEE Open Journal of the Communications Society, vol. 6, pp. 51–76, 2024. DOI: 10.1109/OJCOMS.2024.3517340.
[2] R. Holdbrook, O. Odeyomi, S. Yi, and K. Roy, “Network-Based Intrusion Detection for Industrial and Robotics Systems: A Comprehensive Survey”, Electronics, vol. 13, no. 22, art. no. 4440, 2024.
[3] G. Kumar, K. Kumar, and M. Sachdeva, “The use of artificial intelligence based techniques for intrusion detection: a review”, Artificial Intelligence Review, vol. 34, pp. 369–387, 2010.
[4] H. Nhung-Nguyen, M. Girdhar, Y.-H. Kim, and J. Hong, “Machine-Learning-Based Anomaly Detection for GOOSE in Digital Substations”, Energies, vol. 17, no. 15, 3745, 2024.
[5] T. S. Ustun, S. M. S. Hussain, A. Ulutas, A. Onen, M. M. Roomi, and D. Mashima, “Machine Learning-Based Intrusion Detection for Achieving Cybersecurity in Smart Grids Using IEC 61850 GOOSE Messages”, Symmetry, vol. 13, no. 5, 826, 2021.
[6] A. Aljohani, M. AlMuhaini, H. V. Poor, and H. M. Binqadhi, “A Deep Learning-Based Cyber Intrusion Detection and Mitigation System for Smart Grids”, IEEE Transactions on Artificial Intelligence, vol. 5, no. 8, pp. 3902–3914, Aug. 2024.
[7] E. D. Gutiérrez Mlot, J. Saldana, R. J. Rodríguez, I. Kotsiuba, and C. Gañán, “A dataset to train intrusion detection systems based on machine learning models for electrical substations”, Data in Brief, vol. 57, 111153, 2024.
[8] L. Ruff et al., “Deep Semi-Supervised Anomaly Detection”, arXiv preprint arXiv:1906.02694, 2019.
[9] L. Bottou, “Large-scale machine learning with stochastic gradient descent”, in Proceedings of the 19th International Conference on Computational Statistics (COMPSTAT 2010), Paris, France, Aug. 22–27, 2010, pp. 177–186.
[10] Canadian Institute for Cybersecurity, CICFlowMeter – Applications, www.unb.ca, 2018. [Online]. Available: https://www.unb.ca/cic/research/applications.html. [Accessed: April 5, 2025].
[11] L. Ruff et al., “Deep one-class classification”, in Proceedings of the 35th International Conference on Machine Learning (ICML), PMLR, vol. 80, pp. 4393–4402, 2018.
[12] B. Zong et al., “Deep autoencoding Gaussian mixture model for unsupervised anomaly detection”, in Proceedings of the International Conference on Learning Representations (ICLR), Vancouver, BC, Canada, Apr.–May 2018.
##plugins.themes.academic_pro.article.sidebar##
