Random Forest based Intrusion Detection System for AMI

The next generation in the electricity grid develops an Advanced Metering Infrastructure (AMI) with bi-directional communication. The Internet of Things (IoT) supports AMI to collect data from smart meters and identify the energy consumption pattern of consumers. A widely applied IoT routing protocol in AMI is Routing Protocol for Low-Power and Lossy Networks (RPL). The RPL protocol plays a vital role in ensuring a timely and reliable communication service on AMI. However, several factors affect the reliability of RPL in AMI, and those factors are security, delay, and unequal energy consumption between smart meters. To solve such issues, the Random Forest based Intrusion Detection System (IDS) (RFIDS) is designed for AMI. The proposed RF-IDS takes into account the results of offline traffic analysis using RF. However, it is insufficient to improve the RPL reliability since the design of RPL based only on offline traffic analysis does not necessarily mean that the designed protocol does not perform well online. Rather, the proposed IDS exploits an offline evaluation can be a first step to decide a security measure against several routing metrics. After offline traffic analysis, the RF-IDS can perform online traffic analysis to obtain delay and energy-related metrics. The offline traffic analysis process in RF-IDS selects an important feature set of the RPL protocol and improves the performance of RF over AMI. Moreover, the RF-IDS attempts to improve AMI communication reliability using a balanced energy factor and prolong the lifetime of smart meters in AMI. The efficiency of RF-IDS over AMI in terms of security, reliability, and energy is evaluated using the Cooja simulator.

I. Introduction

The Advanced Metering Infrastructure (AMI) is one of the prominent applications in Smart Grid (SG) [1]. The AMI assists in upgrading the current power system using bidirectional communication between smart meter devices at homes and servers. A widely applied routing protocol in AMI is Routing Protocol for Low-Power and Lossy Networks (RPL) [2]. The next-generation electricity grid, AMI, needs a reliable two-way communication protocol. However, RPL nodes select sub-optimal or insecure routing paths with low-quality links, and they suffer from severe unreliability problems. Moreover, the design of a reliable RPL protocol for AMI systems is a critical challenge due to the adversarial activities and constrained resources of the smart meter nodes [3]. Recently, AMI networks allow huge and various numbers of smart meters. With the expansion of network size and new services in AMI, the packet sending frequency between smart meters and gateway systems grows drastically. It tends to be many issues in the provision of security protection. For example, the attacker can compromise the smart devices in the system to carry out several routing attacks, such as a Rank attack, Hello Flood attack, DoS attack, and Version Number Attack. Therefore, in the AMI with resource-restricted smart meters, how to carry out a reliable and secure routing is particularly important [4].