Detection of Cyber-Physical Attacks on Digital Substation Protection

点击翻译按钮获取中文摘要

Smart grid systems are undergoing a transformation through the convergence of information technology (IT) and operational technology (OT), merging enterprise-level knowledge with operational insights. This vital enhancement improves system automation and visibility, but comes at cost of increasing cyberattack surface. Cyberattacks on smart grid systems have become growingly intelligent exhibiting characteristics that are polymorphic, patient and persistent often involving supply chain deployment. Given the stealth and sophistication of the current cyberthreat landscape, there is a compelling need for early and accurate detection of cyber and coordinated cyber-physical attacks, which is a critical first step for smart grid response and recovery. Moreover, protective relays, the fastest line of defence against power system faults and disturbances, are a rapidly growing target of attacks. This research program addresses the timely and ambitious problem of cyber-physical attack detection in modern smart grid systems with a focus on digital substation protection devices. The resulting data-rich environment arising from IT/OT convergence enables data-driven cyber-physical modelling paradigms and analytics. As such, the proposed research program explores the brave new world of opportunities for data analytics techniques in smart grid attack detection through the following objectives. We aim to: 1) Design enhanced training approaches to increase the robustness of deep learning-based attack detection through the use of generative adversarial networks and adversarial training techniques; 2) Develop a framework for collaborative intrusion detection that incorporates federated learning to detect coordinated cyber-physical attacks; 3) Construct IT/OT honeypots using reinforcement learning to deceptively lure real-world attack signatures for improved modeling and detection of emerging attacks. The proposed approaches have the potential to be transformative to the field of smart grid cyber-physical security. Not only will the results of this research provide the ability to deter cyber-physical attacks before they can be executed, but they will facilitate identification of potential sources of supply chain attacks that is currently considered one of the most compelling problems in smart grid security. Current utility practices that are based on the introduction of security standards and the application of cybersecurity best practices are insufficient, making the proposed research crucial for Canada's critical energy infrastructure defence strategy. Moreover, it is well known that under-resourced communities are more likely to be the victims of IT-based cyberattacks. This work aims to address the potentially heightened power grid threats on these vulnerable populations facilitated through IT/OT convergence illuminating possible inequities in accessibility to safe and secure power.