Intrusion detection system for smart meters

Abstract

Smart meters allow data acquisition from the customers to be conducted frequently and enable customer participation through various demand side response mechanisms. With support of information and communications technology, smart meters can be controlled and monitored remotely over the wireless broadband public network. Therefore, smart meters are vulnerable to cyber attacks due to connectivity and communication through the open space. In the worst case, intrusions into multiple meters can lead to severe cascading events, causing catastrophic dysfunction and wrong data generated by the meter. In this paper, an Intrusion Detection System (IDS) is proposed which contains host-based and network-based anomaly detection systems for the smart grid. The host-based anomaly detection considers temporal anomalies in the grid facilities, e.g., user-interfaces, access point to smart meters. The malicious behaviors of multicast messages, e.g., Sampled Measured Value (SMV), are incorporated in the proposed network-based anomaly detection. The proposed simultaneous intrusion detection method is able to identify the same type of attacks at multiple devices and their locations. The result is a new integrated tool for detection and mitigation of cyber intrusions at a single meter or multiple meters of a power grid.