SCADA-Wireshark Testbed Data-Based Exploratory Data Analytics and Intrusion Detection

The modern power grid is active with a bi-directional flow of energy and stream data. The increased size and complexity of the power transmission network landscape inevitably led to vulnerability to cyber-attacks in these critical infrastructures. Since 2007, with the simulation of the Aurora attack, cyber security preparedness traveled a significant way to safeguard the electricity networks with the advent of sophistication in IEC 61850-based communication systems and SCADA. The contemporary wide area monitoring system (WAMS) that monitors electrical power system state health in near real-time entails collecting and managing enormous stream data. This exposes the system to further attack vulnerability. Using an open-source tool like Wireshark in the OT cybersecurity regime provides a real-world scenario based on different protocols. This paper discusses some realistic challenges for SCADA exploratory data analytics based on PNML testbed-generated Wireshark data.