首页> 外文期刊>Energy Informatics >Comparison of approaches for intrusion detection in substations using the IEC 60870-5-104 protocol
【24h】

Comparison of approaches for intrusion detection in substations using the IEC 60870-5-104 protocol

机译:使用IEC 60870-5-104协议的变电站入侵检测方法的比较

获取原文
           

摘要

Electrical networks of transmission system operators are mostly built up as isolated networks without access to the Internet. With the increasing popularity of smart grids, securing the communication network has become more important to avoid cyber-attacks that could result in possible power outages. For misuse detection, signature-based approaches are already in use and special rules for a wide range of protocols have been developed. However, one big disadvantage of signature-based intrusion detection is that zero-day exploits cannot be detected. Machine-learning-based anomaly detection methods have the potential to achieve that. In this paper, various such methods for intrusion detection in substations, which use the asynchronous communication protocol International Electrotechnical Commission (IEC) 60870-5-104, are tested and compared. The evaluation of the proposed methods is performed by applying them to a data set which includes normal operation traffic and four different attacks. While the results of supervised and semi-supervised machine learning approaches are rather encouraging, the unsupervised and signature-based methods suffer from general bad performance and had difficulties to detect some attacks.
机译:传输系统运算符的电气网络主要建立为孤立的网络,无需访问互联网。随着智能电网的普及,确保通信网络变得更加重要,以避免可能导致可能的停电的网络攻击。为了误用检测,已经使用了基于签名的方法,并且已经开发了各种协议的特殊规则。然而,基于签名的入侵检测的一个巨大缺点是无法检测到零日的漏洞。基于机器学习的异常检测方法有可能实现这一目标。在本文中,测试并比较了使用异步通信协议国际电工委员会(IEC)60870-5-104的变电站中的各种这种入侵检测方法。通过将它们应用于包括正常操作流量和四种不同攻击的数据集来执行所提出的方法的评估。虽然监督和半监督机器学习方法的结果相当令人鼓舞,但无监督和基于签名的方法遭受一般不良性能,并且难以检测到一些攻击。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱:kefu@zhangqiaokeyan.com

京公网安备:11010802029741号 ICP备案号:京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有
  • 客服微信

  • 服务号