Collaborative Research: SHIELD: Strategic Holistic Framework for Intrusion Prevention Using Multi-modal Data in Power Systems

这一NSF项目旨在加强对国家电网的保护，使其免受网络物理攻击。该项目将给依赖实物测量或网络数据的现有检测和预防战略带来变革性的变化。这将通过以下方式实现：(1)融合网络和物理电力系统数据，以更好地检测协调的网络-物理攻击；(2)隔离受影响的网络-物理部分，以遏制整个电力系统的破坏。该项目的智能优点包括：(1)提出了新的方法来生成反映电力系统在正常运行和协调的网络-物理攻击场景下的行为的网络和物理数据；(2)提出了融合电力系统的网络和物理特征的新型入侵检测方法；(3)提出了新的入侵防御方法，将受影响的网络和物理部分隔离开来。该项目的更广泛影响包括：(1)通过最先进的检测和预防战略保护关键基础设施(电力系统)免受网络攻击，(2)通过暑期学校和STEM讲习班对研究生和本科生进行关于网络物理系统安全的培训，以及(3)向产业界和学术界传播研究成果。现代电力系统本质上是网络物理的。然而，现有的攻击检测策略要么利用物理测量，要么利用网络数据。此外，现有的攻击预防策略没有共同隔离受影响的电力系统的网络和物理部分。为了缩小这一差距，该项目建议开发Shield-Strategic整体框架，利用电力系统中的多模式数据进行入侵防御。Shield旨在通过以下方式提供更好的检测和预防性能：(1)网络和物理数据的最佳融合，以改进攻击检测；(2)对电力系统的网络和物理部分进行联合分区，以获得有效的预防结果。为了将Shield开发成实用的体系结构，该项目将考虑以下研究主题：(1)创建正常运行和协调的网络攻击场景下电力系统的网络和物理特征的综合数据集，(2)通过先进的深度机器学习技术开发网络-物理入侵检测策略，以及(3)通过最优联合分区开发网络-物理防御策略。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

This NSF project aims to strengthen the protection of national power grid against cyber-physical attacks. The project will bring transformative changes to the existing detection and prevention strategies that rely either on physical measurements or cyber data. This will be achieved through: (1) the fusion of cyber and physical power system data to better detect coordinated cyber-physical attacks and (2) the isolation of the impacted cyber-physical sections to contain the damage spread across the power system. The intellectual merits of the project include: (1) proposing novel methods to generate cyber and physical data that reflect the behavior of the power system under normal operation and coordinated cyber-physical attack scenarios, (2) proposing novel intrusion detection methods that fuse cyber and physical features from the power system, and (3) proposing novel intrusion prevention methods that isolate the impacted cyber and physical sections of the power system. The broader impacts of the project include: (1) defending critical infrastructures (power systems) against cyber-attacks via state-of-the-art detection and prevention strategies, (2) training of graduate and undergraduate students on cyber-physical system security through summer schools and STEM workshops, and (3) dissemination of research results to both industry and academic communities. Modern power systems are cyber-physical in nature. However, the existing attack detection strategies leverage either physical measurements or cyber data. Furthermore, the existing attack prevention strategies do not jointly isolate the impacted cyber and physical sections of the power system. To close this gap, this project proposes to develop SHIELD - Strategic Holistic framework for Intrusion prEvention using muLti-modal Data in power systems. SHIELD aims to offer better detection and prevention performance via: (1) optimal fusion of cyber and physical data for improved attack detection and (2) joint partitioning of the cyber and physical sections of the power systems for effective prevention results. To develop SHIELD into a practical architecture, the following research thrusts will be considered in this project: (1) Creation of comprehensive datasets of cyber and physical features of power systems under normal operation and coordinated cyber-attack scenarios, (2) Development of cyber-physical intrusion detection strategy via advanced deep machine learning techniques, and (3) Development of cyber-physical prevention strategy via optimal joint partitioning.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.