Collaborative Research: SHIELD: Strategic Holistic Framework for Intrusion Prevention Using Multi-modal Data in Power Systems

NSF的这个项目旨在加强对国家电网的保护，使其免受网络物理攻击。该项目将为现有的依赖物理测量或网络数据的检测和预防战略带来变革。这将通过以下方式实现：（1）融合网络和物理电力系统数据，以更好地检测协调的网络物理攻击，以及（2）隔离受影响的网络物理部分，以遏制整个电力系统的破坏。该项目的知识价值包括：（1）提出新的方法来生成反映电力系统在正常操作和协调的网络-物理攻击场景下的行为的网络和物理数据，（2）提出融合来自电力系统的网络和物理特征的新的入侵检测方法，以及（3）提出隔离电力系统的受影响的网络部分和物理部分的新颖的入侵预防方法。该项目的更广泛影响包括：（1）通过最先进的检测和预防策略保护关键基础设施（电力系统）免受网络攻击，（2）通过暑期学校和STEM研讨会对研究生和本科生进行网络物理系统安全培训，以及（3）向工业界和学术界传播研究成果。现代电力系统本质上是网络物理的。然而，现有的攻击检测策略利用物理测量或网络数据。此外，现有的攻击预防策略并没有共同隔离电力系统中受影响的网络和物理部分。为了弥补这一差距，本项目提出了开发SHIELD -战略整体框架的入侵预防使用多模态数据在电力系统。SHIELD旨在通过以下方式提供更好的检测和预防性能：（1）网络和物理数据的最佳融合，以改进攻击检测;（2）电力系统网络和物理部分的联合分区，以实现有效的预防效果。为了将SHIELD发展成为一个实用的建筑，本项目将考虑以下研究重点：（1）创建电力系统在正常运行和协调网络攻击场景下的网络和物理特征的综合数据集，（2）通过先进的深度机器学习技术开发网络物理入侵检测策略，以及（3）通过最佳联合分区制定网络物理预防策略。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

This NSF project aims to strengthen the protection of national power grid against cyber-physical attacks. The project will bring transformative changes to the existing detection and prevention strategies that rely either on physical measurements or cyber data. This will be achieved through: (1) the fusion of cyber and physical power system data to better detect coordinated cyber-physical attacks and (2) the isolation of the impacted cyber-physical sections to contain the damage spread across the power system. The intellectual merits of the project include: (1) proposing novel methods to generate cyber and physical data that reflect the behavior of the power system under normal operation and coordinated cyber-physical attack scenarios, (2) proposing novel intrusion detection methods that fuse cyber and physical features from the power system, and (3) proposing novel intrusion prevention methods that isolate the impacted cyber and physical sections of the power system. The broader impacts of the project include: (1) defending critical infrastructures (power systems) against cyber-attacks via state-of-the-art detection and prevention strategies, (2) training of graduate and undergraduate students on cyber-physical system security through summer schools and STEM workshops, and (3) dissemination of research results to both industry and academic communities. Modern power systems are cyber-physical in nature. However, the existing attack detection strategies leverage either physical measurements or cyber data. Furthermore, the existing attack prevention strategies do not jointly isolate the impacted cyber and physical sections of the power system. To close this gap, this project proposes to develop SHIELD - Strategic Holistic framework for Intrusion prEvention using muLti-modal Data in power systems. SHIELD aims to offer better detection and prevention performance via: (1) optimal fusion of cyber and physical data for improved attack detection and (2) joint partitioning of the cyber and physical sections of the power systems for effective prevention results. To develop SHIELD into a practical architecture, the following research thrusts will be considered in this project: (1) Creation of comprehensive datasets of cyber and physical features of power systems under normal operation and coordinated cyber-attack scenarios, (2) Development of cyber-physical intrusion detection strategy via advanced deep machine learning techniques, and (3) Development of cyber-physical prevention strategy via optimal joint partitioning.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.