Anomaly Detection Method Based on Bilateral Features for CPPS

The active anomaly detection system of cyber physical power system (CPPS) can make up for the shortcomings of traditional isolation-based defense methods, to detect cyberattacks that breach the security boundary. The traditional detection method based on only communication side features may have high false positive rate and false negative rate. To address this defect, an abnormal traffic detection method is proposed from the perspective of cyber-physical combination, considering the influence of power system state on the communication network traffic. Firstly, based on communication behavior features, a data-driven anomaly detection method is proposed to realize the preliminary screening of abnormal flow. At the same time, the corresponding physical features of abnormal flow are extracted. Then cyberattack flows can be distinguished from the abnormal flows through an abnormal source tracing method based on bilateral characteristics. Based on the cosimulation platform of CPPS, it is verified that the proposed method can reduce the rate of false positive while ensuring a high detection accuracy against cyberattacks.