Deep learning-based autoencoders represent a promising technology for use in network-based attack detection systems. They offer significant benefits in managing unknown network traces or novel attack signatures. Specifically, in the context of critical infrastructures, such as power supply systems, AI-based intrusion detection systems must meet stringent requirements concerning model accuracy and trustworthiness. For the intrusion response, the activation of suitable countermeasures can greatly benefit from additional transparency information (e.g., attack causes). Transformers represent the state of the art for learning from sequential data and provide important model insights through the widespread use of attention mechanisms. This paper introduces a two-stage transformer-based autoencoder for learning meaningful information from network traffic at the packet and sequence level. Based on this, we present a sequential attention weight perturbation method to explain benign and malicious network packets. We evaluate our method against benchmark models and expert-based explanations using the CIC-IDS-2017 benchmark dataset. The results show promising results in terms of detecting and explaining FTP and SSH brute-force attacks, highly outperforming the results of the benchmark model.

Die Digitalisierung der Stationsautomatisierung eröffnet neue Anwendungspotentiale für intelligente Stationsfunktionen in elektrischen Energiesystemen. Die Vernetzung und der Einsatz von IEC 61850 als vereinheitlichter Kommunikationsstandard ist eine wichtige Voraussetzung, erhöhen aber gleichzeitig die Anfälligkeit für IT-Angriffe. Zur Untersuchung der IT-Sicherheit digitaler Stationen wird hierfür eine neu konzipierte cyber-physische Echtzeit-Co-Simulationsplattform vorgestellt. Auf Basis einer Referenzarchitektur eines IP-basierten Umspannwerks wird die Modellierung, Bewertung und Analyse digitaler Stationen für gestörte und ungestörte Betriebsfälle sowie unter Beachtung von IT-Angriffen ermöglicht. Daraufhin werden Ansätze zur Resilienzbewertung sowie Maßnahmen zur IT-Sicherheit für den operativen Betrieb, z. B. die Erkennung cyber-physischer Anomalien, aufgezeigt. The increasing digitalization within station automation enables new applications for intelligent functionalities in substations of electrical power systems. For this, the utilization of IEC 61850 as unified communication standard is a key requirement but also changes the vulnerability for cyber-attacks. For cyber-security investigations of digital substations a cyber-physical real-time co-simulation platform is introduced. A reference architecture of an IP-based substation is presented and enables the modelling, assessment and analysis of digital substation within disturbed and undisturbed grid situations as well as under consideration of cyber-attacks. Based on this, novel approaches and methods for resilience assessment of digital substations and cyber-security measures for operations, e. g. the detection of cyber-physical anomalies, are described and discussed.

This paper presents an investigation into the virtualization of substation protection IED functions using a sophisticated co-simulation environment that integrates virtual intelligent electronic devices (vIEDs) with a real-time power grid simulation. Anchored by the IEC 61850 protocol, this study constructs a virtualized IED framework, emphasizing the encapsulation of protection schemes using the example of different types of overcurrent protection within a containerized vIED. Using open-source software, this study aims to replicate the communication and functional aspects of physical IEDs. This study uses a co-simulation environment that couples virtualized network components with a real-time power grid simulation to validate the vIEDs against real substation hardware. Simulation results from induced short-circuit events confirm the operational congruence of the vIEDs with their physical counterparts, demonstrating their potential to serve as cost-effective and adaptable testbeds for substation automation. This paper concludes that virtualized IEDs represent a cost-effective, flexible alternative for substation automation testing, with future research directed towards increasing the functional complexity and real-world applicability of these virtual systems.

The digitalization of substations leads to a high degree of automation, which is referred to as Digital Substations with the use of the IEC 61850. An increase in cybersecurity is necessary, and technically enabled by detection and incident response systems – security-by-design is currently often secondary. The next transformation step of substations is introduced and outlined in this paper as a cyber-resilient digital substation. Based on a state-of-the-art description, this paper presents a definition of cyber resilience for digital substations as a basis for the introduced cyber resilience monitor. The monitor acts as a central instance for recording, assessing and responding to security threats and incidents. Furthermore, the requirements for the system structure of the cyber-resilient digital substation are shown and underpinned with current research approaches.