Collaborative Research: SHIELD: Strategic Holistic Framework for Intrusion Prevention Using Multi-modal Data in Power Systems

这个NSF项目旨在加强国家电网对网络物理攻击的保护。该项目将为现有的依赖物理测量或网络数据的检测和预防策略带来革命性的变化。这将通过以下方式实现：(1)融合网络和物理电力系统数据，以更好地检测协同网络物理攻击；(2)隔离受影响的网络物理部分，以遏制整个电力系统的损害蔓延。该项目的智力优势包括：(1)提出新的方法来生成反映电力系统在正常运行和协同网络物理攻击场景下的行为的网络和物理数据；(2)提出新的入侵检测方法，融合电力系统的网络和物理特征；(3)提出新的入侵防御方法，隔离受影响的电力系统网络和物理部分。该项目的更广泛影响包括：(1)通过最先进的检测和预防策略保护关键基础设施（电力系统）免受网络攻击，(2)通过暑期学校和STEM研讨会培训研究生和本科生网络物理系统安全，以及(3)向工业界和学术界传播研究成果。现代电力系统本质上是网络物理的。然而，现有的攻击检测策略要么利用物理测量，要么利用网络数据。此外，现有的攻击预防策略不能联合隔离受影响的电力系统的网络和物理部分。为了缩小这一差距，本项目建议开发SHIELD -在电力系统中使用多模态数据进行入侵防御的战略整体框架。SHIELD旨在通过以下方式提供更好的检测和预防性能：(1)网络和物理数据的最佳融合，以改进攻击检测；(2)电力系统的网络和物理部分的联合划分，以获得有效的预防效果。为了将SHIELD发展成为一个实用的架构，本项目将考虑以下研究重点：(1)创建正常运行和协调网络攻击场景下电力系统网络和物理特征的综合数据集；(2)通过先进的深度机器学习技术开发网络物理入侵检测策略；(3)通过最优联合分区开发网络物理防御策略。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

This NSF project aims to strengthen the protection of national power grid against cyber-physical attacks. The project will bring transformative changes to the existing detection and prevention strategies that rely either on physical measurements or cyber data. This will be achieved through: (1) the fusion of cyber and physical power system data to better detect coordinated cyber-physical attacks and (2) the isolation of the impacted cyber-physical sections to contain the damage spread across the power system. The intellectual merits of the project include: (1) proposing novel methods to generate cyber and physical data that reflect the behavior of the power system under normal operation and coordinated cyber-physical attack scenarios, (2) proposing novel intrusion detection methods that fuse cyber and physical features from the power system, and (3) proposing novel intrusion prevention methods that isolate the impacted cyber and physical sections of the power system. The broader impacts of the project include: (1) defending critical infrastructures (power systems) against cyber-attacks via state-of-the-art detection and prevention strategies, (2) training of graduate and undergraduate students on cyber-physical system security through summer schools and STEM workshops, and (3) dissemination of research results to both industry and academic communities. Modern power systems are cyber-physical in nature. However, the existing attack detection strategies leverage either physical measurements or cyber data. Furthermore, the existing attack prevention strategies do not jointly isolate the impacted cyber and physical sections of the power system. To close this gap, this project proposes to develop SHIELD - Strategic Holistic framework for Intrusion prEvention using muLti-modal Data in power systems. SHIELD aims to offer better detection and prevention performance via: (1) optimal fusion of cyber and physical data for improved attack detection and (2) joint partitioning of the cyber and physical sections of the power systems for effective prevention results. To develop SHIELD into a practical architecture, the following research thrusts will be considered in this project: (1) Creation of comprehensive datasets of cyber and physical features of power systems under normal operation and coordinated cyber-attack scenarios, (2) Development of cyber-physical intrusion detection strategy via advanced deep machine learning techniques, and (3) Development of cyber-physical prevention strategy via optimal joint partitioning.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.