Cyber Anomalies Research Articles

A comparative analysis of various machine learning methods for anomaly detection in cyber attacks on IoT networks

This study explores the growing challenges of cybersecurity in the context of rapidly adopted Internet of Things (IoT) technologies, which have become increasingly susceptible to cyber threats. The widespread utilisation of IoT systems intensifies the complex interactions between devices and amplifies the traffic of data, creating various opportunities for cyber adversaries. Consequently, detecting and mitigating cyberattacks targeting IoT systems has emerged as a critical imperative in the field of cybersecurity.The primary objective of this study is to employ various machine learning methods to detect cyber anomalies within IoT systems and subsequently compare the efficacy of these methods. Comparative analysis encompasses various machine learning techniques, including Support Vector Machine (SVM), Artificial Neural Network (ANN), Decision Tree (DT), Logistic Regression (LR), and k-Nearest Neighbours (k-NN). This technical evaluation aims to provide a nuanced perspective on the contributions of these methods to the classification of cyber attacks in IoT systems. Performance analysis of these methods serves as valuable information for cybersecurity experts, offering guidance in the development of robust protection strategies for the IoT ecosystem. As IoT security continues to gain prominence, the findings of this study are poised to contribute significantly to the refinement of cybersecurity practices and the fortification of IoT environments against potential threats. In this study, we use different machine learning methods to detect anomalies in cyber attacks on IoT systems and compare the performance of these methods. The result shows that the neural network performed better than the other models.

Mitigating Cyber Anomalies in Virtual Power Plants Using Artificial-Neural-Network-Based Secondary Control with a Federated Learning-Trust Adaptation

Virtual power plants (VPPs) are susceptible to cyber anomalies due to their extensive communication layer. FL-trust, an improved federated learning (FL) approach, has been recently introduced as a mitigation system for cyber-attacks. However, current FL-trust enhancements, relying solely on proportional-integral (PI), exhibit drawbacks like sensitivity to controller gain fluctuations and a slow response to sudden disturbances, and conventional FL-trust is not directly applicable to the non-independent and identically distributed (non-IID) datasets common in VPPs. To address these limitations, we introduce an artificial neural network (ANN)-based technique to adapt FL-trust to non-IID datasets. The ANN is designed as an intelligent anomaly mitigation control method, employing a dynamic recurrent neural network with exogenous inputs. We consider the effects of the most common VPP attacks, poisoning attacks, on the distributed cooperative controller at the secondary control level. The ANN is trained offline and tested online in the simulated VPP. Using MATLAB simulations on a HOMER-modeled VPP, the proposed technique demonstrates its superior ability to sustain normal VPP operation amidst cyber anomalies, outperforming a PI-based mitigation system in accuracy and detection speed.

BGP Dataset-Based Malicious User Activity Detection Using Machine Learning

Recent advances in the Internet and digital technology have brought a wide variety of activities into cyberspace, but they have also brought a surge in cyberattacks, making it more important than ever to detect and prevent cyberattacks. In this study, a method is proposed to detect anomalies in cyberspace by consolidating BGP (Border Gateway Protocol) data into numerical data that can be trained by machine learning (ML) through a tokenizer. BGP data comprise a mix of numeric and textual data, making it challenging for ML models to learn. To convert the data into a numerical format, a tokenizer, a preprocessing technique from Natural Language Processing (NLP), was employed. This process goes beyond merely replacing letters with numbers; its objective is to preserve the patterns and characteristics of the data. The Synthetic Minority Over-sampling Technique (SMOTE) was subsequently applied to address the issue of imbalanced data. Anomaly detection experiments were conducted on the model using various ML algorithms such as One-Class Support Vector Machine (One-SVM), Convolutional Neural Network–Long Short-Term Memory (CNN–LSTM), Random Forest (RF), and Autoencoder (AE), and excellent performance in detection was demonstrated. In experiments, it performed best with the AE model, with an F1-Score of 0.99. In terms of the Area Under the Receiver Operating Characteristic (AUROC) curve, good performance was achieved by all ML models, with an average of over 90%. Improved cybersecurity is expected to be contributed by this research, as it enables the detection and monitoring of cyber anomalies from malicious users through BGP data.

Data-driven Approach for State Prediction and Detection of False Data Injection Attacks in Smart Grid

In a smart grid, state estimation (SE) is a very important component of energy management system. Its main functions include system SE and detection of cyber anomalies. Recently, it has been shown that conventional SE techniques are vulnerable to false data injection (FDI) attack, which is a sophisticated new class of attacks on data integrity in smart grid. The main contribution of this paper is to propose a new FDI attack detection technique using a new data-driven SE model, which is different from the traditional weighted least square based SE model. This SE model has a number of unique advantages compared with traditional SE models. First, the prediction technique can better maintain the inherent temporal correlations among consecutive measurement vectors. Second, the proposed SE model can learn the actual power system states. Finally, this paper shows that this SE model can be effectively used to detect FDI attacks that otherwise remain stealthy to traditional SE-based bad data detectors. The proposed FDI attack detection technique is evaluated on a number of standard bus systems. The performance of state prediction and the accuracy of FDI attack detection are benchmarked against the state-of-the-art techniques. Experimental results show that the proposed FDI attack detection technique has a higher detection rate compared with the existing techniques while reducing the false alarms significantly.

Cyber-Resilient Cooperative Control of DC Microgrid Clusters

Inthis article, we propose a novel, model-independent, unified detection strategy based on disagreement Laplacian potential for effective identification of cyber anomalies in interconnected autonomous direct current (dc) microgrid (MG) clusters. This interconnection enables inter and intra-microgrid power exchange between them, thereby rendering efficient and maximum utilisation of the distributed energy resources. However, these clusters are vulnerable to cyber intrusion that disrupt the power sharing schemes. As such, we have investigated the effect of false data injections at various vulnerable points, including both voltage and current sensors in primary, and data transmission points in the distributed secondary, local, and global tertiary layers. Simultaneously, a logical evaluation in the form of data-integrity indices are formulated from the outcomes of the proposed detection scheme to provide for their timely mitigation. Ultimately a fault-ride through operation of the converters is achieved instead of alienating the misbehaving component, unlike previously reported works.

Using Embedded Feature Selection and CNN for Classification on CCD-INID-V1-A New IoT Dataset.

As Internet of Things (IoT) networks expand globally with an annual increase of active devices, providing better safeguards to threats is becoming more prominent. An intrusion detection system (IDS) is the most viable solution that mitigates the threats of cyberattacks. Given the many constraints of the ever-changing network environment of IoT devices, an effective yet lightweight IDS is required to detect cyber anomalies and categorize various cyberattacks. Additionally, most publicly available datasets used for research do not reflect the recent network behaviors, nor are they made from IoT networks. To address these issues, in this paper, we have the following contributions: (1) we create a dataset from IoT networks, namely, the Center for Cyber Defense (CCD) IoT Network Intrusion Dataset V1 (CCD-INID-V1); (2) we propose a hybrid lightweight form of IDS—an embedded model (EM) for feature selection and a convolutional neural network (CNN) for attack detection and classification. The proposed method has two models: (a) RCNN: Random Forest (RF) is combined with CNN and (b) XCNN: eXtreme Gradient Boosting (XGBoost) is combined with CNN. RF and XGBoost are the embedded models to reduce less impactful features. (3) We attempt anomaly (binary) classifications and attack-based (multiclass) classifications on CCD-INID-V1 and two other IoT datasets, the detection_of_IoT_botnet_attacks_N_BaIoT dataset (Balot) and the CIRA-CIC-DoHBrw-2020 dataset (DoH20), to explore the effectiveness of these learning-based security models. Using RCNN, we achieved an Area under the Receiver Characteristic Operator (ROC) Curve (AUC) score of 0.956 with a runtime of 32.28 s on CCD-INID-V1, 0.999 with a runtime of 71.46 s on Balot, and 0.986 with a runtime of 35.45 s on DoH20. Using XCNN, we achieved an AUC score of 0.998 with a runtime of 51.38 s for CCD-INID-V1, 0.999 with a runtime of 72.12 s for Balot, and 0.999 with a runtime of 72.91 s for DoH20. Compared to KNN, XCNN required 86.98% less computational time, and RCNN required 91.74% less computational time to achieve equal or better accurate anomaly detections. We find XCNN and RCNN are consistently efficient and handle scalability well; in particular, 1000 times faster than KNN when dealing with a relatively larger dataset-Balot. Finally, we highlight RCNN and XCNN’s ability to accurately detect anomalies with a significant reduction in computational time. This advantage grants flexibility for the IDS placement strategy. Our IDS can be placed at a central server as well as resource-constrained edge devices. Our lightweight IDS requires low train time and hence decreases reaction time to zero-day attacks.

Dynamic Topology Awareness in Active Distribution Networks Using Blockchain-Based State Estimations

With growing complexity and uncertainty from distributed generations and active customers, distribution networks are facing more unexpected events and topology changes; while very limited measurements may degrade the observability of distribution system states and endanger the security of the system. Meanwhile, massive data from various types of users (if they can be used), can be valuable for power utilities. This makes privacy and data security a more critical issue, while being endowed with operation and market flexibilities. Thus, we propose a blockchain-based privacy-protecting approach for Dynamic Topology Awareness (DTA) to distinguish topology changes from cyber anomalies, including physical, cyber and business layers. At the bottom layer (physical layer), the distribution network is partitioned into subareas and tie-line areas, coping with local data from measurement devices or users. Estimated border values from parallel local estimations would be examined through data consistency checking. And DTA consensus algorithm might be triggered, querying historical status stored as blockchain contracts for anomalies detections and new block formations. Voting mechanism is then adopted to verify new blocks from data tampering. The performance of the proposed DTA approach is validated through simulations to identify topology changes and cyber anomalies, with additional discussions on the trade-off between DTA sensitivity and estimation accuracy.

Intelligent anomaly identification in cyber-physical inverter-based systems

Modern cyber-physical systems have become more autonomous and distributed with the inclusion of advanced control architectures and communication networks. Power electronics-based inverters that employ extensive communication structures are integral part of such systems. The controllers for inverter-based systems rely on communication networks that make them vulnerable to cyber-physical anomalies. The cyber anomalies occur due to malicious attacks targeting the communication layer and physical anomalies are caused by power system faults in the physical layer of the microgrid. In this work, an intelligent anomaly identification (IAI) technique for such systems is presented utilizing data driven artificial intelligence tools that employ multi class support vector machines (MSVM) for anomaly classification and localization. The effects of cyber anomalies such as false data injection and denial of service attacks that target the communication network are considered in this work. In addition, the physical anomalies due to power system faults are also considered. The proposed technique utilizes statistical features extracted from measurements for optimal learning of a dual of MSVM classifiers. The mean absolute percentage error is used as a performance metric and the results are validated by comparing to artificial neural network, Naive Bayes classification and using real time simulations in OPAL-RT.

Cyber Physical Security Analytics for Anomalies in Transmission Protection Systems

Protection systems are one of the most critical components in the transmission system and are becoming more digital with ongoing automation. These digital systems are prone to vulnerabilities/attacks, and exploitation of these vulnerabilities may cause major impacts on the electric grid performance. Multiple alarms reported in the control center could be a result of the faults (expected operations) or failures in the protection system (anomalies/ unexpected operation). Situational awareness gained through sensors such as a phasor measurement unit (PMU) and data acquired through the cyber system provide an opportunity to develop continuous cyber-physical monitoring of the system. Note that relay data are not reported in the control center continuously. This paper presents a cyber-physical data analytics based technique to monitor transmission protection system and detect malicious activity. Initially, continuous monitoring of PMU data is utilized for data anomaly detection, which includes bad or missing data using long short-term memory (LSTM). Then, PMU data of interest are utilized for failure diagnosis, using a semisupervised deep autoencoder model. In this research, cyber anomalies are modeled by manipulating the setting/logic design of protective devices, and a ridge regression based classifier with a feature engineering pipeline is used to detect cyber anomalies. The results from the deep autoencoder model and ridge regression based classifier are then utilized for detailed investigation to find the root causes of the observed events assisted by the cyber log data from the protection devices. The algorithm is validated using a real-time simulation of the IEEE test system with industrial hardware relays and PMUs in the loop. Data analytics algorithm running on server utilizes these real-time data continuously for anomaly detection and classification for the developed use cases.

On the Generation of Anomaly Detection Datasets in Industrial Control Systems

In recent decades, Industrial Control Systems (ICS) have been affected by heterogeneous cyberattacks that have a huge impact on the physical world and the people’s safety. Nowadays, the techniques achieving the best performance in the detection of cyber anomalies are based on Machine Learning and, more recently, Deep Learning. Due to the incipient stage of cybersecurity research in ICS, the availability of datasets enabling the evaluation of anomaly detection techniques is insufficient. In this paper, we propose a methodology to generate reliable anomaly detection datasets in ICS that consists of four steps: attacks selection, attacks deployment, traffic capture and features computation. The proposed methodology has been used to generate the Electra Dataset, whose main goal is the evaluation of cybersecurity techniques in an electric traction substation used in the railway industry. Using the Electra dataset, we train several Machine Learning and Deep Learning models to detect anomalies in ICS and the performed experiments show that the models have high precision and, therefore, demonstrate the suitability of our dataset for use in production systems.