Cyberattacks identification in IEC 61850 based substation using proximal support vector machine

1 Introduction

Generally, conventional power system network is formulated in form of a smart-grid with incorporation of the advanced ICT (Information and Communication Technologies) for the communication in between the protective devices through the LANs (Local Area Networks) of the substation and/or TCP (Transmission Control Protocol)/IP (Internet Protocol) networks by using high speed Ethernet. The utilization of these ICTs enable the optimal level of operation and control of the smart-grid with minimal level of restrictions. Therefore, several schemes for the ICTs have been developed and followed the standard communication protocol for smart power system applications.

The communication in smart SAS (Substation Automation System) is a key component to maintain the real-time operations. Initially, TSbRCU (Telephone Switching based Remote Control Unit) was utilized in power station in early 1930. In 1960, the DCN (Digital Communication Network) become more popular through the DAS (Data Acquisition System) to collect the measured dataset automatically. The main problem with DAS is to operate at LBCC (Low Bandwidth Communication Channel). Due to this, DCN based on DAS is not a proper solution for transmission of signals in between protecting devices. Thereafter, a standard communication protocol based on IEC 61850 is developed for the electric SAS by using IEEE 802-3 high speed Ethernet to communicate in between IEDs (Intelligent Electronic Devices). Generally, IEDs also support to sample/collect the dataset, transmit the dataset, multi-port communication, security and interoperability of different devices. Due to these reasons, the utilization of IEC 61850 based communication protocols is increased in the SAS throughout the world, which leads the high concerns for the cybersecurity and its associated cyber-attacks in modern power system substation (MPSS).

The energy is becoming a prime concern due to its effect on economy, nation security, and society. So, its generation, transmission, distribution and demand matching are the key factor in the 21^st century to prevent the blackout condition. In this regard, numerous researches have studied to protect the SAS from the cyberattacks which effect the security of the system. For an example of a security breach like: 1) integrity breach due to FDI (False data Injection), MITM (Man-In-The-Middle); 2) confidentiality breach due to Eavesdropping, theft; 3) availability breach due to DoS, DDoS; 4) authentication breach due to malware, Trojan; and 5) authorization breach due to malware, Trojan, spoofing etc. Moreover, authors in [1–6] presented an IDS (Intrusion Detection System) to analyze the threats in the recent years. In [1]. Authors detect the insider threats by using specification-based detection method. In [2], authors identify the routing attacks by using anomaly based detection method. In [3], authors developed the hybrid signature and specification based detection method for identification of the multiple conventional attacks (MCA) as well as system disturbance. In [4] and [5], authors developed anomaly based detection method for MCA and DoS respectively. In [6], authors detect the security attacks of MCA by using signature based method. Apart of this, authors in [7–10] presented an FDI (False Data Injection) to analyze the threats and detect for the prevention of the system. Moreover, in [11–13] authors presented and demonstrated ITD (Insider Threats Detection).

In this study, a signature based cyberattacks identification in IEC 61850 based substation using PSVM (proximal support vector machine) is proposed. The main reason to opt PSVM as an identifier that it is very fast algorithm in process, compared with other ICT and advance machine learning algorithms.

2 Brief Detail of IEC 61850

IEC 61850 is a standard which define the communication protocols for IEDs at electrical power substation. In IEC 61850, the pulled away or detached data model can be mapped to a number of protocols. These protocols are GOOSE (Generic Object Oriented Substation Event), MMS (Manufacturing Message Specification), SVM (Sampled Measured Values) and WS (Web Services –future services). These protocols of IEC 61850 are used to receive the essential response times less than 4 milliseconds for all protective relaying through the LANs of the substation and/or TCP/IP networks by using Ethernet. Moreover, IEC 61850 is an OOP (Object Oriented Protocol) as compared with older protocols which are SOP (Signal Oriented Protocols) such as 10004, 21015 from devices 1,2, etc.

IEC TC 57 (Technical Committee from 22 participating countries) was established in 1964 to fulfill an urgent need to develop a standard in the field of communications between equipments and systems to control the electric power system. The IEC 61850 is a series of standards as mentioned in Table 1, out of them some are directly related to substation automation of the power system (SAPS), which are highlighted into green colour.

Generally, SAPS suffers with different types of attacks such as intrusion attacks, MITM (Man-In-The-Middle) attacks, DoS attacks, and FDI (false data injection) attacks. The intrusion attacks effect the integrity, confidentiality and authenticity of the GOOSE, VM and substation LAN and/or TCP/IP network. The MITM attacks effect the integrity, confidentiality and authenticity of the MMS. Similarly, DoS attacks effect the authenticity of the MMS. Finally, FDI effect the authenticity, and physical security of the IEDs. Due to these attacks, confidentiality, integrity, availability and physical security are effected, so that unauthorized access of information, unauthorized modification, theft of information, and unauthorized access of IEDs or nodes will be performed by attacker. That is why power system network is failed to meet the customer demand. For the detailed information, reader may refer [15–20] for intrusion attacks for GOOSE and SV, [21] for intrusion attacks for substation LAN, [22] for MITM attacks for MMS, [23] for DoS attacks for MMS, and [24, 25] for FSI attacks for IEDs.

To manage these attacks scenarios in the smart power substation, IEC TC 57 address the distinct cybersecurity issues related with communication protocols for IEDs of IEC 61850. The IEC TC 57 developed the IEC 62351 to provide the cybersecurity solution for all possible attacks on IEC 61850. The IEC 62351 is a series of standards as mentioned in Table 2 along with its brief detail.

In this study, IEC 18650 based substation security dataset has been collected from experimental set (created in lab based proto-type) and open access data base [27], which includes normal data, disturbances data and attack-scenarios dataset. The Fig. 1 of the [27] represents the one-line diagram of a power substation of 66/11 kV system, which has been used to generate these datasets. This power system diagram includes the four-buses, 18 IEDs (Intelligent Electronic Devices), 10 feeders (i.e., 6 are used to connect the loads and 4 are used to connect other substations), 2 transformers, several circuit breakers.

OPEN IN VIEWER

Fig. 1

Proposed approach framework.

The three main types of attack scenarios of GOOSE attacks are created such as: 1) DoS (denial of services), 2) MS (message suppression) and 3) DM (data manipulation). The Dos attack is created in a malicious attempt by the attacker to block IED through flooding bogus frames. The MS attacks are created through hijacking of communication channel through the changing GOOSE header fields from the updating/receiving the IED from the message. Similarly, the DM attacks are created by injecting the modified network payloads into the main network, which is effect the grid stability. The collected datasets under these three attack scenarios are used for the further study.

The proposed intelligent cyberattacks identification approach for IEC 61850 based SAS using PSVM is presented in Fig. 1, which is comprises into six-parts as follow: 1) PART-1: experiment setup for digital substation based on IEC-61850, 2) PART-2: online measurement of the datasets (i.e., current, voltage, power, harmonics and frequency etc.), 3) PART-3: data pre-processing (data analysis), 4) PART-4: training and testing dataset matrices formation, 5) PART-5: design the PSVM model, and 6) PART-6: train the designed PSVM model then test its performance with test dataset. Once optimal level of training and testing is performed then developed model may be recommended for the further uses in real-side SAS implementation.

5.1 PSVM based model formulation [28–32]

Generally, PSVM is utilized for classification problems [28]. Due to its high processing speed and limited number of lines in whole coding, it is widely used for both linear as well as non-linear problems. PSVM is the advanced version of the standard SVM. In the SVM, the dataset is classified with a separating plane of narrow band, whereas in PSVM, the separating plan is bigger with the high level of the proximity. The hyperplane for SVM and PSVM is shown in Figs. 2 and 3 respectively.

OPEN IN VIEWER

Fig. 2

The standard SVM classifier in the w-space of R ⁿ with error margin 2 ∥ w ∥ [xx].

OPEN IN VIEWER

Fig. 3

The PSVM classifier in the (ω, λ)- space of Rⁿ⁺¹ with error margin 2 ∥ ω γ ∥ [xx].

Figure 4 shows the procedure of PSVM implementation. PSVM is taken as m data points in Rⁿ⁺¹ represented using two matrices as matix Q (m × n) and diagonal matrix G (m × m) with labeled of±1. The label±1 represents the class of each row of matrix Q. The mathematical implementation for classifier using PSVM is shown in following steps [28–32]:

OPEN IN VIEWER

Fig. 4

Flow Chart for PSVM Implementation [16].

Step# 1: Express M as: M = G [Q - ɛ]

Where ɛ= m × 1 which is a vector of 1 and

Calculates η using positive different μ values: η = μ ( ( 1 - M ( 1 μ + M ′ M ) - 1 ) M ′ ) ɛ(8)

η can also be calculated as: η = μ * ( 1 - ( M * ϑ ) )(9)

where ϑ is represented as: ϑ = ( speye ( n + 1 ) / μ + M ′ * M ) ∖ Y(10)

and Y = sum (M) ′.

The optimal value for μ is defined as per the expert experience (range:10⁶ to 0.01). It is suggested that bigger value of μ provides superior fitting for training data, most of cases, μ = 1 is best.

Step# 2: Calculate (ω, λ) ω = Q ′ * G η ; λ = - ɛ ′ * G η and τ = η / μ(11)

The maximization of the margin accordance to location (λ) and orientation (ω) w.r.t. origin.

Step# 3: New unlabeled dataset of X _new is classified as: ( Xnew ′ ω - λ ) = { > 0 , < 0 , = 0 , then then then Xnew ∈ A + ; Xnew ∈ A - ; Xnew ∈ A + or Xnew ∈ A - ;(12)

The detected label of tested new dataset is represented by Equation 13: f ( Xnew ) = sign ( ω ′ * Xnew - λ )(13)

Where, f (Xnew)=negative, then dataset is classified as class#1 (A -), and f (x)=positive, then dataset is classified as class#2 (A+),

For the multi-class problem, multiple binary PSVM classifiers are developed in a combination.

5.2 PSVM based cyberattacks identification model formulation

Based on proposed approach as represented in Fig. 1, the cyberattacks identification model using PSVM (CAIM) for SAS is given in Fig. 5.

OPEN IN VIEWER

Fig. 5

Classification approach using PSVM models.

The CAIM for SAS includes three-binary PSVM classifiers which are utilized to classify four (i.e., healthy operation and three cyberattacks: DoS, MS, and DM) conditions of the SAS.

For the demonstration of the PSVM CAI performance, PSVM#1 (model-1) is trained with the whole training dataset and segregate the healthy condition from the all faulty conditions (i.e., DoS, MS and DM). For this, the used code for healthy condition representation is -1. Now, PSVM#2 (model-2) is trained by using ghettoized faulty data from model-1 for three faults scenarios. The used code at the output side of PSVM#2 is -1 for ghettoizing the faults conditions “Dos and MS” from the “DM”. Now, PSVM#3 (model-3) is trained by using the ghettoised faulty data of “DoS and MS” achieved from model-2 for two faults conditions. The used code at the output side of PSVM#3 is -1 to ghettoize the faults condition “DM” from the “DoS”. In the summary of all output codes utilized for representation of all conditions at the output side of the PSVM models are represented in Table 3.

OPEN IN VIEWER

Table 3

Summary codification of all developed PSVM models

Fault Category	PSVM Model#1	PSVM Model #2	PSVM Model #3
Healthy	–1	Θ	Θ
DoS	+1	–1	Θ
MS	+1	–1	+1
DM	+1	+1	–1

Θ = not in use.

In this section, the performance analysis of the developed CAIM for SAS is presented. The results demonstration is performed by using experimental datasets of four different operating condition of SAS under two different categories, as shown in Table 4. The Table 4 shows the highest identification accuracy of the particular CAIMs out of all developed models with variation of Nu values. The category#1 and category#2 are the based on voltage and current signatures respectively. Three different CAIM are developed for each category to classify the four operating conditions of the SAS. The classification accuracy for category#1 is varies from 91.05 to 99.83 (for training phase), 90.55 to 96.63 (for testing phase). And the average diagnosis accuracy for category#1 is 96.85 and 94.27 for training and testing phase respectively. Apart of this, the class-wise classification accuracy for the proposed PSVM model of category2 has been represented in Table 5, which shows the diagnosis accuracy for each type of fault along with healthy operating condition.

In this study, twelve different PSVM models for the case of PSVM#1 are developed with variation of twelve different Nu-values (Range: -1 to 100) and similar study is performed for all other PSVM models (i.e., PSVM#2 and PSVM#3) as shown in Fig. 6 to Fig. 8 for both categories. Hence, total thirty six PSVM models are developed and analyzed for the category#1. Similarly, thirty six PSVM models are developed and analyzed for the category#2 as well. Hence, in this study, total seventy two PSVM models are designed and analyzed for both categories of study. Moreover, the evaluated w and gamma for all PSVM models are represented in Figs. 9, 10 and 11 respectively.

OPEN IN VIEWER

Fig. 6

Traing and testing accuracy with variation of Nu-value for PSVM#1.

OPEN IN VIEWER

Fig. 7

Traing and testing accuracy with variation of Nu-value for PSVM#2.

OPEN IN VIEWER

Fig. 8

Traing and testing accuracy with variation of Nu-value for PSVM#3.

OPEN IN VIEWER

Fig. 9

Evaluated weight value for all PSVM models for category#1.

OPEN IN VIEWER

Fig. 10

Evaluated weight value for all PSVM models for category#2.

OPEN IN VIEWER

Fig. 11

Evaluated Gamma value for all PSVM models –vG for category#1 and iG for category#2.

In this study, different cyberattacks have been identified and analyzed. The proposed approach for cyberattacks identification in IEC 61850 based SAS using proximal support vector machine has been developed and demonstrated for four different case scenarios such as healthy and three attacks scenarios (i.e., DoS, MS and DM). The performance of the proposed approach has been demonstrated using experimental dataset of recorded signatures under two different categories. The total 72 intelligent models have been developed and demonstrated to validate its performance. The obtained results of the demonstrated study shown the effectiveness and high level of acceptability for real side implementation to protect the SAS from the cyberattacks in different scenarios.