Integration of the Internet into the entities of the different domains of human society (such as smart homes, health care, smart grids, manufacturing processes, product supply chains, and environmental monitoring) is emerging as a new paradigm called the Internet of Things (IoT). However, the ubiquitous and wide-range IoT networks make them prone to cyberattacks. One of the main types of attack is a denial of service (DoS), where the attacker floods the network with a large volume of data to prevent nodes from using the services. An intrusion detection mechanism is considered a chief source of protection for information and communications technology. However, conventional intrusion detection methods need to be modified and improved for application to the IoT owing to certain limitations, such as resource-constrained devices, the limited memory and battery capacity of nodes, and specific protocol stacks. In this paper, we develop a lightweight attack detection strategy utilizing a supervised machine learning-based support vector machine (SVM) to detect an adversary attempting to inject unnecessary data into the IoT network. The simulation results show that the proposed SVM-based classifier, aided by a combination of two or three incomplex features, can perform satisfactorily in terms of classification accuracy and detection time.

Being one of the most multifaceted cyber-physical systems, smart grids (SGs) are arguably more prone to cyber-threats. A covert data integrity assault (CDIA) on a communications network may be lethal to the reliability and safety of SG operations. They are intelligently designed to sidestep the traditional bad data detector in power control centers, and this type of assault can compromise the integrity of the data, causing a false estimation of the state that further severely distresses the entire power system operation. In this paper, we propose an unsupervised machine learning-based scheme to detect CDIAs in SG communications networks utilizing non-labeled data. The proposed scheme employs a state-of-the-art algorithm, called isolation forest, and detects CDIAs based on the hypothesis that the assault has the shortest average path length in a constructed random forest. To tackle the dimensionality issue from the growth in power systems, we use a principal component analysis-based feature extraction technique. The evaluation of the proposed scheme is carried out through standard IEEE 14-bus, 39-bus, 57-bus, and 118-bus systems. The simulation results show that the proposed scheme is proficient at handling non-labeled historical measurement datasets and results in a significant improvement in attack detection accuracy.

This paper deals with the problem of fault detection and diagnosis in sensors considering erratic, drift, hard-over, spike, and stuck faults. The data set containing samples of the above mentioned fault signals was acquired as follows: normal data signals were obtained from a temperature-to-voltage converter by using an Arduino Uno microcontroller board and MATLAB. Then, faults were simulated in normal data to get 100 samples of each fault, in which one sample is composed of 1000 data elements. A support vector machine (SVM) was used for data classification in a one-versus-rest manner. The statistical time-domain features, extracted from a sample, were used as a single observation for training and testing SVM. The number of features varied from 5 to 10 to examine the effect on accuracy of SVM. Three different kernel functions used to train SVM include linear, polynomial, and radial-basis function kernels. The fault occurrence event in fault samples was chosen randomly in some cases to replicate a practical scenario in industrial systems. The results show that an increase in the number of features from 5 to 10 hardly increases the total accuracy of the classifier. However, using ten features gives the highest accuracy for fault classification in an SVM. An increase in the number of training samples from 40 to 60 caused an overfitting problem. The k-fold cross-validation technique was adopted to overcome this issue. The increase in number of data elements per sample to 2500 increases the efficiency of the classifier. However, an increase in the number of training samples to 400 reduces the capability of SVM to classify stuck fault. The receiver operating characteristics curve comparison shows the efficiency of SVM over a neural network.

Smart grids have become susceptible to cyber-attacks, being one of the most diversified cyber-physical systems. Measurements collected by the supervisory control and data acquisition system can be compromised by a smart hacker, who can cheat a bad-data detector during state estimation by injecting biased values into the sensor-collected measurements. This may result in false control decisions, compromising the security of the smart grid, and leading to financial losses, power network disruptions, or a combination of both. To overcome these problems, we propose a novel approach to cyber-attacks detection, based on an extremely randomized trees algorithm and kernel principal component analysis for dimensionality reduction. A performance evaluation of the proposed scheme is done by using the standard IEEE 57-bus and 118-bus systems. Numerical results show that the proposed scheme outperforms state-of-art approaches while improving the accuracy in detection of stealth cyber-attacks in smart-grid measurements.