Deep learning-based autoencoders represent a promising technology for use in network-based attack detection systems. They offer significant benefits in managing unknown network traces or novel attack signatures. Specifically, in the context of critical infrastructures, such as power supply systems, AI-based intrusion detection systems must meet stringent requirements concerning model accuracy and trustworthiness. For the intrusion response, the activation of suitable countermeasures can greatly benefit from additional transparency information (e.g., attack causes). Transformers represent the state of the art for learning from sequential data and provide important model insights through the widespread use of attention mechanisms. This paper introduces a two-stage transformer-based autoencoder for learning meaningful information from network traffic at the packet and sequence level. Based on this, we present a sequential attention weight perturbation method to explain benign and malicious network packets. We evaluate our method against benchmark models and expert-based explanations using the CIC-IDS-2017 benchmark dataset. The results show promising results in terms of detecting and explaining FTP and SSH brute-force attacks, highly outperforming the results of the benchmark model.

Die Digitalisierung der Stationsautomatisierung eröffnet neue Anwendungspotentiale für intelligente Stationsfunktionen in elektrischen Energiesystemen. Die Vernetzung und der Einsatz von IEC 61850 als vereinheitlichter Kommunikationsstandard ist eine wichtige Voraussetzung, erhöhen aber gleichzeitig die Anfälligkeit für IT-Angriffe. Zur Untersuchung der IT-Sicherheit digitaler Stationen wird hierfür eine neu konzipierte cyber-physische Echtzeit-Co-Simulationsplattform vorgestellt. Auf Basis einer Referenzarchitektur eines IP-basierten Umspannwerks wird die Modellierung, Bewertung und Analyse digitaler Stationen für gestörte und ungestörte Betriebsfälle sowie unter Beachtung von IT-Angriffen ermöglicht. Daraufhin werden Ansätze zur Resilienzbewertung sowie Maßnahmen zur IT-Sicherheit für den operativen Betrieb, z. B. die Erkennung cyber-physischer Anomalien, aufgezeigt. The increasing digitalization within station automation enables new applications for intelligent functionalities in substations of electrical power systems. For this, the utilization of IEC 61850 as unified communication standard is a key requirement but also changes the vulnerability for cyber-attacks. For cyber-security investigations of digital substations a cyber-physical real-time co-simulation platform is introduced. A reference architecture of an IP-based substation is presented and enables the modelling, assessment and analysis of digital substation within disturbed and undisturbed grid situations as well as under consideration of cyber-attacks. Based on this, novel approaches and methods for resilience assessment of digital substations and cyber-security measures for operations, e. g. the detection of cyber-physical anomalies, are described and discussed.

The dynamic operation of power transmission systems requires the acquisition of reliable and accurate measurement and state information. The use of TCP/IP-based communication protocols such as IEEE C37.118 or IEC 61850 introduces different gateways to launch cyber-attacks and to compromise major system operation functionalities. Within this study, a combined network intrusion and phasor data anomaly detection system is proposed to enable a secure system operation in the presence of cyber-attacks for dynamic control centers. This includes the utilization of expert-rules, one-class classifiers, as well as recurrent neural networks to monitor different network packet and measurement information. The effectiveness of the proposed network intrusion and phasor data anomaly detection system is shown within a real-time simulation testbed considering multiple operation and cyber-attack conditions.

Synchrophasor based applications become more and more popular in today’s control centers to monitor and control transient system events. This can ensure secure system operation when dealing with bidirectional power flows, diminishing reserves and an increased number of active grid components. Today’s synchrophasor applications provide a lot of additional information about the dynamic system behavior but without significant improvement of the system operation due to the lack of interpretable and condensed results as well as missing integration into existing decision-making processes. This study presents a holistic framework for novel machine learning based applications analyzing both historical as well as online synchrophasor data streams. Different methods from dimension reduction, anomaly detection as well as time series classification are used to automatically detect disturbances combined with a web-based online visualization tool. This enables automated decision-making processes in control centers to mitigate critical system states and to ensure secure system operations (e.g., by activating curate actions). Measurement and simulation-based results are presented to evaluate the proposed synchrophasor application modules for different use cases at the transmission and distribution level.

The automated identification and localisation of grid disturbances is a major research area and key technology for the monitoring and control of future power systems. Current recognition systems rely on sufficient training data and are very error‐prone to disturbance events, which are unseen during training. This study introduces a robust Siamese recurrent neural network using attention‐based embedding functions to simultaneously identify and locate disturbances from synchrophasor data. Additionally, a novel double‐sigmoid classifier is introduced for reliable differentiation between known and unknown disturbance types and locations. Different models are evaluated within an open‐set classification problem for a generic power transmission system considering different unknown disturbance events. A detailed analysis of the results is provided and classification results are compared with a state‐of‐the‐art open‐set classifier.