Cybersecurity of the substations in a power system is a major issue as the substations become increasingly dependent on computer and communication networks. This paper is concerned with anomaly detection in the computer network environment of a substation. An anomaly inference algorithm is proposed for early detection of cyber-intrusions at the substations. The potential scenario of simultaneous intrusions launched over multiple substations is considered. The proposed detection method considers temporal anomalies. Potential intrusion events are ranked based on the credibility impact on the power system. Snapshots of anomaly entities at substations are described. Simulation results using the modified IEEE 118-bus system have shown the effectiveness of the proposed method for systematic identification. The result of this research is a tool to detect cyber-intrusions that are likely to cause significant damages to the power grid.

Cyber intrusions to substations of a power grid are a source of vulnerability since most substations are unmanned and with limited protection of the physical security. In the worst case, simultaneous intrusions into multiple substations can lead to severe cascading events, causing catastrophic power outages. In this paper, an integrated Anomaly Detection System (ADS) is proposed which contains host- and network-based anomaly detection systems for the substations, and simultaneous anomaly detection for multiple substations. Potential scenarios of simultaneous intrusions into the substations have been simulated using a substation automation testbed. The host-based anomaly detection considers temporal anomalies in the substation facilities, e.g., user-interfaces, Intelligent Electronic Devices (IEDs) and circuit breakers. The malicious behaviors of substation automation based on multicast messages, e.g., Generic Object Oriented Substation Event (GOOSE) and Sampled Measured Value (SMV), are incorporated in the proposed network-based anomaly detection. The proposed simultaneous intrusion detection method is able to identify the same type of attacks at multiple substations and their locations. The result is a new integrated tool for detection and mitigation of cyber intrusions at a single substation or multiple substations of a power grid.

Autonomous driving (AD) has developed tremendously in parallel with the ongoing development and improvement of deep learning (DL) technology. However, the uptake of artificial intelligence (AI) in AD as the core enabling technology raises serious cybersecurity issues. An enhanced attack surface has been spurred on by the rising digitization of vehicles and the integration of AI features. The performance of the autonomous vehicle (AV)-based applications is constrained by the DL models' susceptibility to adversarial attacks despite their great potential. Hence, AI-enabled AVs face numerous security threats, which prevent the large-scale adoption of AVs. Therefore, it becomes crucial to evolve existing cybersecurity practices to deal with risks associated with the increased uptake of AI. Furthermore, putting defense models into practice against adversarial attacks has grown in importance as a field of study amongst researchers. Therefore, this study seeks to provide an overview of the most recent adversarial defensive and attack models developed in the domain of AD.

This paper proposes the new concept of intelligent electronic devices (IEDs) with built-in distributed intrusion detection systems. The proposed IEDs have the capabilities to monitor and detect anomalies and abnormal behaviors of the host system of IED and IEC 61850-based messages, e.g., sampled values and generic object oriented substation event. The proposed IEDs collaborate with neighboring IEDs to make an accurate decision and find the origin of cyber attacks. The commodity embedded system has been used to verify the performance of the proposed intrusion detection system with power system protection functions of IEDs. The results show that the proposed mitigation methods work accurately and efficiently with protection functions, e.g., overcurrent and distance protections, on the embedded board.

This paper proposes new concepts for detecting and mitigating cyber attacks on substation automation systems by domain-based cyber-physical security solutions. The proposed methods form the basis of a distributed security domain layer that enables protection devices to collaboratively defend against cyber attacks at substations. The methods utilize protection coordination principles to cross check protection setting changes and can run real-time power system analysis to evaluate the impact of the control commands. The transient fault signature (TFS)-based cross-correlation coefficient algorithm has been proposed to detect the false sampled values data injection attack. The proposed functions were verified in a hardware-in-the-loop (HIL) simulation using commercial relays and a real-time digital simulator (RTDS). Various types of cyber intrusions are tested using this test bed to evaluate the consequences and impacts of cyber attacks to power grid as well as to validate the performance of the proposed research-grade cyber attack mitigation functions.

A power grid is a critical infrastructure that relies on supervisory control and data acquisition (SCADA) systems for monitoring, control, and operation. On top of the power infrastructure reside layers of information and communications technology (ICT) that are interconnected with electric grids. The cyber and power infrastructures together constitute a large, complex cyberphysical system. ICTs on the power grids have evolved from isolated structures into open and networked environments based on TCP/IP and Ethernet. The technology is known to be vulnerable with respect to cyberintrusions. As ICTs of the power infrastructure have evolved into highly connected network environments, the use of firewalls has become a widely adopted access control method against intruders. Firewalls do not guarantee cybersecurity, however. The misconfiguration of company firewalls has been reported. Even if the configuration of a firewall is correct, it is still vulnerable because firewalls are not able to detect insider attacks and connections from the trusted side. Hence, solutions based solely on firewalls can be inadequate.