Intrusion Detection for Cybersecurity of Smart Meters
Intrusion Detection for Cybersecurity of Smart Meters
复制标题
DOI：
10.1109/tsg.2020.3010230
复制
发表时间：
2021-01-01
影响因子：
9.6
通讯作者：
Liu, Chen-Ching
中科院分区：
文献类型：
--
作者：
Sun, Chih-Che;Cardenas, D. Jonathan Sebastian;Liu, Chen-Ching
信息和通信技术(ICT)的集成使智能电表参与电力系统运行的实时通信成为可能。然而，高级计量基础设施(AMI)很容易受到网络攻击。公用事业公司和电力消费者都可能成为网络入侵的受害者。本文提出了一种两级网络入侵防御系统。在入侵检测的第一阶段，使用支持向量机作为检测算法来发现智能电表内部的可疑行为。在第二阶段，使用时态故障传播图(TFPG)技术生成用于识别攻击事件的攻击路径。最后，将提出的模式识别算法用于计算检测到的异常事件与预定义的网络攻击之间的相似度。相似度值越高，表示智能电表受到攻击的可能性越高。开发了一个AMI安全测试平台，用于：(1)收集支持向量机的训练/测试数据；(2)模拟和分析网络攻击事件；(3)验证所提出的网络攻击防护系统。该测试平台由用于模拟AMI网络环境的网络仿真器3(NS-3)软件和用于模拟电网路由器与智能电表之间的IEEE 802.15.4通信的单板计算机(SBC)组成。
The integration of Information and Communications Technology (ICT) enables real-time communication for smart meters to participate in power system operations. However, Advanced Metering Infrastructures (AMI) are vulnerable to cyber attacks. Both utilities and power consumers may become victims of cyber intrusions. In this paper, a two-stage cyber intrusion protection system is proposed. At the first stage of intrusion detection, a Support Vector Machine (SVM) is used as a detection algorithm to discover suspicious behaviors inside a smart meter. At the second stage, the Temporal Failure Propagation Graph (TFPG) technique is used to generate attack routes for identifying attack events. Finally, the proposed pattern recognition algorithm is used to calculate the similarity between a detected abnormal event and pre-defined cyber attacks. A higher similarity value implies a higher chance that a smart meter is under attack. An AMI security test platform has been developed to: (1) Collect training/testing data for SVM, (2) Simulate and analyze cyber attack events, and (3) Validate the proposed cyber attack protection system. The test platform consists of Network-Simulator 3 (NS-3) software to simulate an AMI network environment and single board computers (SBCs) to emulate the IEEE 802.15.4 communication between a grid router and a smart meter.