A Laboratory Set-Up for Cyber Attacks Simulation Using Protocol Analyzer and RTU Hardware Applying Semi-Supervised Detection Algorithm

The integration of Information and Communication Technologies (ICT) into the modern power system makes it a complicated cyber-physical system (CPS). In this case, an adversary may find some loopholes, penetrate to CPS layer, compromise data, and consequently result in security and stability issues. In this paper, we proposed a laboratory set up to emulate the attacker's behavior and then detect the injected false data. To this end, RTU hardware and software are used to simulate a typical SCADA system. A protocol analyzer software is also employed to simulate a cyber-attack, inject false data, and send it to the control center. In the second stage, we developed a two-stage framework to detect FDIA. First, the LSTM, as a supervised learning algorithm, is utilized to build a predictive model. In this process, hyperparameter optimization is implemented to improve the accuracy of the developed model. In the second stage, an unsupervised scoring algorithm is applied to the real-time data to find the sequences of injected false data. Also, a penalty factor is considered during the detection procedure to prevent the algorithm from greedy search behavior. Simulation results on a real-world data set (Chicago load/weather) show the proposed method's effectiveness in the cyberattack implementation and FDIA detection problem.

I. Introduction

The modern power systems are highly dependent on Information and Communication Technologies (ICT), making it a form of Cyber-Physical System (CPS). This deep integration of physical and cyber systems leads to some loopholes between these two sections, makes the power grid vulnerable to the cyber attack. Consequently, it results in the national economy and public safety issues as well as security and stability problems [1], [2]. As a case in point, disruptions to Ukraine's power system in 2015 and 2016 were attributed to a cyberattack and led to power outages affecting hundreds of thousands of people [3], [4]. Also, there have been media reports of attempted attacks on the electricity grids in some European countries and reports of companies that manage energy facilities in the U.S. being compromised by hackers [5], [6]. There are different types of attacks such as code manipulation (changing the software/firmware), command manipulation, false data injection attack (manipulating the data without affecting the code), network-based attack (physical communication link), communication-based attacks, database manipulation, password cracking, etc. (Fig. 1) [7].