Encrypted Traffic Classification for Early-Stage Anomaly Detection in Power Grid Communication Network

Secure communication networks are crucial for the proper functioning of power grid infrastructure. Anomaly detection is essential for maintaining network security, but most existing methods rely on power system measurement anomalies that appear only after an attack has been effectively executed. Identifying attacks in their early stages, primarily through communication network-based anomalies, is therefore essential. However, the fast-paced proliferation of encrypted traffic conceals a significant amount of malicious activities. This paper proposes a novel framework for early-stage anomaly detection using deep-learning-based traffic classification. In our approach, wavelet transforms and byte-to-image transformation is used to extract features from encrypted traffic flow in the networks secured by the IPsec protocol suite. Experimental results show that our proposed method achieves 93% accuracy in detecting abnormal traffic. The framework presents a promising solution for early-stage anomaly detection in power grid communication networks and could serve as a valuable addition to critical infrastructure security measures.