Abstract
Among the key components of a smart grid, advanced metering infrastructure (AMI) has become the preferred target for network intrusion due to its bidirectional communication and Internet connection. Intrusion detection systems (IDSs) can monitor abnormal information in the AMI network, so they are an important means by which to solve network intrusion. However, the existing methods exhibit a poor ability to detect intrusions in AMI, because they cannot comprehensively consider the temporal and global characteristics of intrusion information. To solve these problems, an AMI intrusion detection model based on the cross-layer feature fusion of a convolutional neural networks (CNN) and long short-term memory (LSTM) networks is proposed in the present work. The model is composed of CNN and LSTM components connected in the form of a cross-layer; the CNN component recognizes regional features to obtain global features, while the LSTM component obtain periodic features by memory function. The two types of features are aggregated to obtain comprehensive features with multi-domain characteristics, which can more accurately identify intrusion information in AMI. Experiments based on the KDD Cup 99 and NSL-KDD datasets demonstrate that the proposed cross-layer feature-fusion CNN-LSTM model is superior to other existing methods.
Highlights
The feature fusion component is composed of multi-layer perceptrons (MLPs), which are mainly used to fuse the features extracted from the convolutional neural networks (CNN) and long short-term memory (LSTM) components and to normalize the classification probability to obtain the final result
advanced metering infrastructure (AMI) is composed of a wide area network (WAN), home area network (HAN), and neighborhood area network (NAN), which are connected with household appliances, smart electricity meters, concentrators, data processing centers, and other critical nodes
The training and testing of the model were completed in the Windows operating system, and TensorFlow in the Python Deep learning (DL) library was used to realize the programming of the proposed cross-layer feature fusion CNN-LSTM intrusion detection model
Summary
Publisher’s Note: MDPI stays neutral with regard to jurisdictional claims in published maps and institutional affiliations. After the two types of features are fused via a feature fusion component, multi-scale and multi-domain abnormal information can be detected This model combines the advantages of both the CNN and LSTM, so it exhibits good performance in AMI intrusion detection. The proposed model combines the characteristics of the CNN and LSTM and can more effectively identify intrusion information in AMI; The fusion feature is adopted to represent the multi-domain characteristics of the data. This avoids the limitations of single features and achieves the complementation of advantages among different features; The proposed model was evaluated on the KDD Cup 99 and NSL-KDD datasets, both of which are rich in samples and contain all possible types of attacks of AMI.
Sign-in/Register to view highlights & summary Sign-in/Register to access full text options 
Free) 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a call
