False Data Injection Attack Detection, Isolation, and Identification in Industrial Control Systems Based on Machine Learning: Application in Load Frequency Control
Abstract
:1. Introduction
- The LFC model of a two-area interconnected smart grid is simulated in Python, and different types of attacks are injected into the system. Various ML algorithms are tested to classify the normal and abnormal behavior of the system during the attack period.
- Operational technology is utilized to train multi-classification machine learning algorithms to identify the attack types, leveraging exploited measurement data.
- The proposed method is employed to accurately locate the origin of detected faults in the LFC system, thereby aiding human operators in managing incidents more effectively and promptly.
2. LFC Model
- and represent the state and control vectors for the ith area, respectively;
- indicates the load deviation for the ith area;
- is the measurement vector of the ith area, with accounting for any bounded noise affecting measurements;
- is an n-dimensional identity matrix representing interactions between different grid areas.
3. False Data Detection, Isolation, and Identification
3.1. Learning-Based FDII Mechanism
3.2. Methodology
3.2.1. Off-Line Process
3.2.2. On-Line Process
3.3. Evaluation Metrics
4. Case Study: Load Frequency Control
LFC Under Attack
5. Simulation Results and Discussion
5.1. Fault Detection
5.2. Fault Isolation
5.3. Fault Identification
6. Practical Applicability of the Proposed FDII Mechanism
6.1. Challenges and Considerations
6.2. Potential Limitations
7. Conclusions
Future Research Directions
Author Contributions
Funding
Data Availability Statement
Conflicts of Interest
References
- Leppänen, S.; Ahmed, S.; Granqvist, R. Cyber Security Incident Report—Norsk Hydro. Procedia Econ. Financ. 2019, 11. Available online: https://mycourses.aalto.fi/pluginfile.php/923542/mod_folder/content/0/Group%20CSS%20Norsk%20Hydro%202019.pdf (accessed on 2 August 2024).
- Abbaspour, A.; Sargolzaei, A.; Forouzannezhad, P.; Yen, K.K.; Sarwat, A.I. Resilient control design for load frequency control system under false data injection attacks. IEEE Trans. Ind. Electron. 2019, 67, 7951–7962. [Google Scholar] [CrossRef]
- Li, Y.; Huang, R.; Ma, L. False data injection attack and defense method on load frequency control. IEEE Internet Things J. 2020, 8, 2910–2919. [Google Scholar] [CrossRef]
- Qi, R.; Rasband, C.; Zheng, J.; Longoria, R. Detecting Cyber Attacks in Smart Grids Using Semi-Supervised Anomaly Detection and Deep Representation Learning. Information 2021, 12, 328. [Google Scholar] [CrossRef]
- Alzubi, J.A. Bipolar fully recurrent deep structured neural learning based attack detection for securing industrial sensor networks. Trans. Emerg. Telecommun. Technol. 2021, 32, e4069. [Google Scholar] [CrossRef]
- Sayghe, A.; Hu, Y.; Zografopoulos, I.; Liu, X.; Dutta, R.G.; Jin, Y.; Konstantinou, C. Survey of machine learning methods for detecting false data injection attacks in power systems. IET Smart Grid 2020, 3, 581–595. [Google Scholar] [CrossRef]
- IEEE Std 802.15.4-2020 (Revision of IEEE Std 802.15.4-2015); IEEE Standard for Low-Rate Wireless Networks. IEEE: Piscataway, NJ, USA, 2020; pp. 1–800. [CrossRef]
- Jokar, P.; Leung, V.C.M. Intrusion detection and prevention for ZigBee-based home area networks in smart grids. IEEE Trans. Smart Grid 2016, 9, 1800–1811. [Google Scholar] [CrossRef]
- Revathi, S.; Malathi, A. A detailed analysis on NSL-KDD dataset using various machine learning techniques for intrusion detection. Int. J. Eng. Res. Technol. (IJERT) 2013, 2, 1848–1853. [Google Scholar]
- Tavallaee, M.; Bagheri, E.; Lu, W.; Ghorbani, A.A. A detailed analysis of the KDD CUP 99 data set. In Proceedings of the 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, Ottawa, ON, Canada, 8–10 July 2009; pp. 1–6. [Google Scholar]
- Aboelwafa, M.M.N.; Seddik, K.G.; Eldefrawy, M.H.; Gadallah, Y.; Gidlund, M. A machine-learning-based technique for false data injection attacks detection in industrial IoT. IEEE Internet Things J. 2020, 7, 8462–8471. [Google Scholar] [CrossRef]
- Ramotsoela, D.T.; Hancke, G.P.; Abu-Mahfouz, A.M. Attack detection in water distribution systems using machine learning. Hum.-Centric Comput. Inf. Sci. 2019, 9, 13. [Google Scholar] [CrossRef]
- Mokhtari, S.; Abbaspour, A.; Yen, K.K.; Sargolzaei, A. A machine learning approach for anomaly detection in industrial control systems based on measurement data. Electronics 2021, 10, 407. [Google Scholar] [CrossRef]
- Moustafa, N.; Slay, J. UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). In Proceedings of the Military Communications and Information Systems Conference (MilCIS), Canberra, ACT, Australia, 10–12 November 2015. [Google Scholar]
- Maseer, Z.K.; Yusof, R.; Bahaman, N.; Mostafa, S.A.; Foozy, C.F.M. Benchmarking of machine learning for anomaly based intrusion detection systems in the CICIDS2017 dataset. IEEE Access 2021, 9, 22351–22370. [Google Scholar] [CrossRef]
- Kumar, A.; Choi, B.J. Benchmarking Machine Learning based Detection of Cyber Attacks for Critical Infrastructure. In Proceedings of the 2022 International Conference on Information Networking (ICOIN), Jeju-si, Republic of Korea, 12–15 January 2022; pp. 24–29. [Google Scholar]
- Gheisarnejad, M.; Khooban, M.H. Secondary load frequency control for multi-microgrids: HiL real-time simulation. Soft Comput. 2019, 23, 5785–5798. [Google Scholar] [CrossRef]
- Mokhtari, S.; Yen, K.K. Measurement data intrusion detection in industrial control systems based on unsupervised learning. Appl. Comput. Intell. 2021, 1, 61–74. [Google Scholar] [CrossRef]
- Chawla, N.V.; Bowyer, K.W.; Hall, L.O.; Kegelmeyer, W.P. SMOTE: Synthetic minority over-sampling technique. J. Artif. Intell. Res. 2002, 16, 321–357. [Google Scholar] [CrossRef]
- Chandrashekar, G.; Sahin, F. A survey on feature selection methods. Comput. Electr. Eng. 2014, 40, 16–28. [Google Scholar] [CrossRef]
- Zheng, A.; Casari, A. Feature Engineering for Machine Learning: Principles and Techniques for Data Scientists; O’Reilly Media, Inc.: Newton, MA, USA, 2018. [Google Scholar]
- Ahmed, M.; Pathan, A.-S.K. False data injection attack (FDIA): An overview and new metrics for fair evaluation of its countermeasure. Complex Adapt. Syst. Model. 2020, 8, 4. [Google Scholar] [CrossRef]
Attack No. 1 | Attack No. 2 | Attack No. 3 | Attack No. 4 | |||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|
KNN | RF | DTC | KNN | RF | DTC | KNN | RF | DTC | KNN | RF | DTC | |
Precision | 1.0 | 1.0 | 1.0 | 0.80 | 0.98 | 0.97 | 0.99 | 1.0 | 1.0 | 0.93 | 0.93 | 0.89 |
Recall | 1.0 | 1.0 | 1.0 | 0.78 | 0.98 | 0.97 | 0.98 | 1.0 | 1.0 | 0.92 | 0.92 | 0.89 |
F1 score | 1.0 | 1.0 | 1.0 | 0.78 | 0.98 | 0.97 | 0.99 | 1.0 | 1.0 | 0.92 | 0.92 | 0.89 |
Accuracy | 1.0 | 1.0 | 1.0 | 0.78 | 0.98 | 0.97 | 0.99 | 1.0 | 1.0 | 0.92 | 0.92 | 0.89 |
AUC | 1.0 | 1.0 | 1.0 | 0.78 | 0.98 | 0.97 | 0.99 | 1.0 | 1.0 | 0.92 | 0.92 | 0.89 |
Training time [ms] | 0.92 | 23.73 | 2.11 | 1.06 | 32.41 | 5.14 | 2.35 | 27.60 | 31.15 | 2.44 | 26.76 | 11.01 |
Prediction time [ms] | 19.87 | 5.21 | 0.75 | 23.42 | 6.26 | 0.31 | 31.15 | 5.68 | 1.02 | 27.74 | 8.34 | 1.01 |
Multi-Class Algorithm | Average Accuracy | Training Time [s] | Prediction Time [s] |
---|---|---|---|
Multi-Output Classifier (MOC) | 1.0 | 4.67 | 0.98 |
Multi-k-nearest neighbour (MLKNN) | 1.0 | 2.29 | 1.84 |
One-Vs.-One Classifier (OVOC) | 0.99 | 0.128 | 0.026 |
One-Vs.-Rest Classifier (OVRC) | 0.98 | 0.164 | 0.003 |
Output-Code Classifier (OCC) | 0.97 | 0.85 | 0.007 |
Binary Relevance Classifier (BRC) | 0.93 | 0.022 | 0.008 |
Multi-Class Algorithm | Average Accuracy | Training Time [s] | Prediction Time [s] |
---|---|---|---|
Multi-Output Classifier (MOC) | 0.986 | 4.31 | 1.38 |
Multi-k-nearest neighbour (MLKNN) | 0.982 | 2.13 | 1.72 |
One-Vs.-One Classifier (OVOC) | 0.85 | 0.096 | 0.006 |
One-Vs.-Rest Classifier (OVRC) | 0.87 | 0.123 | 0.002 |
Output-Code Classifier (OCC) | 0.80 | 0.297 | 0.003 |
Binary Relevance Classifier (BRC) | 0.85 | 0.012 | 0.005 |
Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content. |
© 2024 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/).
Share and Cite
Mokhtari, S.; Yen, K.K. False Data Injection Attack Detection, Isolation, and Identification in Industrial Control Systems Based on Machine Learning: Application in Load Frequency Control. Electronics 2024, 13, 3239. https://doi.org/10.3390/electronics13163239
Mokhtari S, Yen KK. False Data Injection Attack Detection, Isolation, and Identification in Industrial Control Systems Based on Machine Learning: Application in Load Frequency Control. Electronics. 2024; 13(16):3239. https://doi.org/10.3390/electronics13163239
Chicago/Turabian StyleMokhtari, Sohrab, and Kang K. Yen. 2024. "False Data Injection Attack Detection, Isolation, and Identification in Industrial Control Systems Based on Machine Learning: Application in Load Frequency Control" Electronics 13, no. 16: 3239. https://doi.org/10.3390/electronics13163239