Safe and reliable intelligent charging stations are imperative in an intelligent transportation infrastructure. Over the past few years, a big number of smart charging stations have been deployed, and most of them are online and connected, resulting in potential risks of threats. Although there exists related work on securing intelligent vehicles, very little work focused on the security of charging devices. Unlike traditional network systems, these power-related Industrial Control Systems (ICSs) use many different proprietary protocols and diverse interactions. Traditional anomaly detection methods based on network traffic are thus not suitable for these systems. In this work, we propose an anomaly detection method in real vehicle power supply systems based on a deep architecture model. In particular, we propose a novel traffic anomaly detection model based on Multi-Head Attentions (MHA) that take into account the inherent correlations of traffic generated by ICSs. The MHA model is employed to substitute the traditional feature extraction and rule making process with an acceptable computational cost for classifying traffic data. It is an attention-based model that employs Google Transformer encoder architecture to extract recessive features of traffic for anomaly detection. The effectiveness of the model is demonstrated by experiments on two real-world power ICS testbeds including a substation with a slave charging station and a power generation simulation platform based on a distributed control system. Comprehensive experimental results indicate that the MHA model outperforms the Convolutional Neural Networks (CNN)-based and classical machine learning detection models with an accuracy rate of 99.86%.

As distributed photovoltaic (PV) technology rapidly develops and is widely applied, the methods of cyberattacks are continuously evolving, posing increasingly severe threats to the communication networks of distributed PV systems. Recent studies have shown that the Transformer model, which effectively integrates global information and handles long-distance dependencies, has garnered significant attention. Based on this, our research proposes a model named STformer, which is applied to the task of attack detection in distributed PV communication. Specifically, we propose a temporal attention mechanism and a variable attention mechanism. The temporal attention mechanism focuses on capturing subtle changes and trends in data sequences over time, ensuring a highly sensitive recognition of patterns inherent in time-series data. In contrast, the variable attention mechanism analyzes the intrinsic relationships and interactions between different variables, uncovering critical correlations that may indicate abnormal behavior or potential attacks. Additionally, we incorporate the Uniform Manifold Approximation and Projection (UMAP) dimensionality reduction technique. This technique not only helps reduce computational complexity but, in certain cases, can enhance anomaly detection performance. Finally, compared to classical and advanced methods, STformer demonstrates satisfactory performance in simulation experiments.

In industrial control systems, terminal devices in fieldbus networks are vulnerable to physical intrusion attacks, where attackers can directly install external intrusion devices. Currently, the localization capabilities of existing methods for intrusion devices are limited. As the reflection signals in transmitted signals are imperceptible and difficult to extract, many methods focus on actively transmitting pulse signals to locate intrusion devices. In this article, we enhance the reflection signals in transmitted signals by parallel connection of an appropriate resistor with the gateway and propose a localization method based on the collaboration of multiple devices' reflection signals. This method can significantly improve localization precision while reducing the sampling rate and does not occupy communication bandwidth. Experimental results on a real-world controller area network testbed demonstrate that our method can achieve a localization precision of 5 cm when locating intrusion devices under a sampling rate of 50 MS/s.

Nowadays, a large number of new terminal devices are connected to the power system, which greatly increases the risk of network attacks on the terminal and network channels. In order to ensure the safe connection of the power system, it needs to establish the correct identification of the new terminal. For the security threat scenario of traditional terminal identification, this paper studies the fingerprint extraction and recognition technology of devices in the security field of physical layer and transport layer. Device fingerprint is a hardware feature formed by the difference between the electronic components of the device itself. Like biological fingerprint, it has the characteristics of difficult to forge, and can be applied to device authentication to obtain higher security. In this paper, the periodicity of the consistent scrambling of idle data is used to calculate the amplitude spectrum and autocorrelation power spectrum of the signal to extract the fingerprint of NIC. Furthermore, an interactive behavioral feature extraction based on UDP protocol is proposed, which ICMP-ECHO round trip time distribution as a device fingerprint.

The characteristics of the new-type business terminals, such as the integration of various applications, complex external interactions and enhanced edge intelligence, pose three major challenges to the security protection of the company. These challenges encompass creating significant difficulties for security protection systems based on boundary isolation, existing authentication methods facing challenges in maintaining a balance between security and flexibility, and the incapacity to identify unknown attacks. To address the security issues arising from the widespread integration of new-type business terminals, the increasingly blurred network boundaries, and the significantly enlarged system exposure surface, this article develops a terminal-side prototype with flexible secure access and unknown attack awareness and defense. This paper also creates a secure access gateway with the capability to perceive and defend against unknown attacks. In addition, pilot verifications are conducted in typical scenarios of new-type business terminals, offering efficient and flexible secure access, cloud-edge collaborative defense against unknown attacks, and other technological support. Therefore, we are able to provide precise and adequate defense capabilities to ensure the efficient development of new-type power system business.