The traditional power grid system is no longer a viable option due to increasing user demand, upsurge in availability of renewable energy resources, outdated infrastructure, and the need for increased security and reliability. The Smart Grid (SG) constitutes advanced technologies such as Supervisory Control and Data Acquisition (SCADA), Advanced Metering Infrastructure (AMI), Plug-In Electric Vehicles (PEVs) and Renewable Energy Resources (RERs), and offers a variety of new features such as demand side management, a two-way communication framework and real time pricing [1]. These additional features and technologies in SG also create new challenges that have to be addressed. RERs are expected to become a major source of power in the SG by the year 2050. These renewable energy resources are collected using different sources/technologies, are often geographically distributed, disparate in nature and operation, and have lower generation capacity in comparison to the conventional energy resources. To efficiently couple the conventional with the renewable energy resources, there is a need for timely and reliable SG communication [2].
In addition, with new communication technology, there are various kinds of cyber attacks that may occur such as Man-In-The-Middle attacks, Jamming, Black hole attacks, Energy Drain attacks, Sinkhole attacks, and Denial of Service attacks. A successful cyber-attack on SG in the Ukraine during December of 2016 caused a blackout which impacted 225,000 customers [3]. Many cyber attacks also have the potential of leading SG into total collapse [4]. A resilient SG should have the ability to detect, identify and react to sudden system failures through natural causes or intentional attacks on the network. For instance, during Denial of Service attack on SG, a Phasor Measurement Unit (PMU) or multiple PMUs might get compromised which will result in the loss of measurement data from the relevant part of the grid. In such cases, SG will lose the system observability of all the associated substations in the grid, which might result in temporary power outages or blackouts.
Software Defined Networks (SDN) has proved to be a reliable and efficient architecture for handling diverse communication systems. With its ability to separate data plane from the control plane, SDN can provide control and management for various SG entities such as utility, smart meters, and AMI, and play an instrumental role in evolving SG to integrate new services, resources, technologies and needs as the SG evolves. In this paper, we propose a graph learning approach for an SDN based SG security (GLASS) framework. GLASS adopts a two phase strategy for detecting and identifying Distributed Denial of Service (DDoS) attacks. To our knowledge, this is the first study to use supervised and unsupervised graph learning approaches to detect and identify cyber attacks in a SDN-SGC system. This paper specifically makes the following contributions:
• Uses graph convolutional neural networks (GCN) to detect DDoS attacks for various attack scenarios; • Uses spectral clustering to identify DDoS compromised entities; and • Analyzes the impact of the detection, identification and mitigation of DDoS attacks on network performance (throughput, transmission delay).
The remainder of the paper is organized as follows. Section II provides background information on SDN-SGC architecture and graph learning approaches. Section III provides details about the proposed GLASS framework for DDoS detection and identification. Results of a case study are discussed in Section IV. Finally, Section V concludes the paper by summarizing results and providing future research directions for the GLASS framework. As mentioned previously, SDN is a networking paradigm in which the forwarding hardware is decoupled from control decisions. The network intelligence is logically centralized in software-based controllers (the control plane), and the network devices become simple packet forwarding devices (the data plane) that can be programmed via an open interface. SDNs help to assemble new services and infrastructure quickly to meet dynamically changing environment objectives. Furthermore, the software implementation of the control plane and the built-in data collection mechanisms are excellent tools to implement additional analysis layers for network control. Extracting knowledge from collected data to understand and predict the state of the SG network will be crucial to implement security management in the SG. Our system will ingest network traffic performance statistics and monitor the data for anomalies/attacks.
This work focuses on developing methods for detection and mitigation of the Distributed Denial-of-Service (DDoS) cyber attacks discussed in [5], [6]. During Denial-of-Service (DoS) attacks, the attacker intentionally disrupts the transmission of data to/from a given node through an excessive amount of service requests to the victim node, consuming all available resources. The impact factor of DoS attacks are high. This type of attack increases network traffic at its victim node (i.e. arrival rate) to consume the victim's resources and extend queue length resulting in an increase in wait times or transmission delays as can be seen in [7]. This can cause nodes to shutdown, and negatively effect the entire network as a whole. Distributed Denial of Service (DDoS) has an even larger impact, since the attack occurs from multiple nodes, resulting in a higher arrival/attack rate. In the attack model considered, a PMU subsystem may be attacked in order to hinder or disconnect it from the rest of the network. If a PMU subsystem is attacked, the slowed/halted communication of data could introduce substantial errors into the SG system.
Supervised learning deals with the class of machine learning problems in which we have a labelled dataset guiding the model on what decisions to make while it is being trained. In these problems, learning, or the adaptation of the model, is supervised by the desired response. Traditional supervised deep learning approaches such as Multilayer Perceptron Neural Networks, Convolutional Neural Networks, etc cannot be directly applied on graph based data as they fail to extract latent representations from non-euclidean data generated by complex relationships and interdependence between various entities in graphs [8]. Recently, many deep learning approaches have been extended for graph based data, resulting in Graph Neural Networks, Graph Convolutional Neural Networks, and Graph Auto-encoders [9]. The Graph Convolutional Neural Networks (GCN) [10] concept was developed using concepts of convolutional neural networks and Graph Neural Networks. GCN is useful for solving real world problems such as link prediction, node classification and graph classification. GCN aims to learn the hidden layer repre-sentations that encode features of nodes, local graph structures or even entire graphs.
Unsupervised learning deals with the class of machine learning problems in which we do not have a labelled dataset to train a model. Instead we rely on capturing undetected patterns in the data through techniques like modeling probability densities, extracting embeddings, calculating distance measures etc [11] . One of the commonly used applications of unsupervised learning is clustering. One of the most popular clustering algorithms is Spectral Clustering, since it can be solved using simple linear algebra libraries and often produces better results than traditional clustering algorithms such as K-means algorithm [12]. Spectral clustering is useful for identifying "groups of nodes" which show similar behavior in a graph. Spectral clustering relies on weighted adjacency matrix of the graph to be indicative of different behaviors exhibited by different groups of nodes, for example, victim (compromised) nodes and normal nodes in the network.
In this section, we discuss the design of GLASS framework.
We model SDN-SGC as a weighted undirected Graph G = (V, E, W V , W E ) with N number of PMUs in the SG considered as the node set V and the connections between them considered as the edge set E. The quality of communication between neighboring PMUs is quantified by various network performance metrics such as transmission delay, throughput etc. These performance metrics are used to form node attribute matrix W V ∈ R N ×f N and edge attribute matrix W E ∈ R |E|×f E , where f V and f E represent number of node attributes and edge attributes respectively.
We divide the entire length of simulation into T number of time steps and model SDN-SGC in each of these time steps as G t where t ∈ 1, 2, 3..., T . G t varies in each time step as W V and W E changes over time depending on the communication between PMUs in the SG. At time step t, we use the transmission delay between neighboring PMUs to form W t E and the average transmission delay of a PMU with all of its neighboring PMUs to form W t V . Note that W V and W E should be designed using information from the network that is representative of the problem at hand. Let W t adj ∈ R N ×N be the weighted adjacency matrix of G t formed such that w ij is edge weight between PMUs i and j if they are connected, else
In the DDoS detection phase of our framework, we make use of the concepts of neural networks on graphs to train models that are guided to detect any intentional/unintentional anomalous behavior in SDN-SGC network. The objective of this phase is to detect whether a SDN-SGC network modeled by G t is under any DDoS attacks. We develop our DDoS detection models based on the concepts of graph convolutional layers and graph pooling proposed in [10], [13], [14]. As shown in Fig. 1, the graph information modeled from SDN-SGC network is passed through multiple graph convolution layers, followed by a single graph pooling layer which is followed by multiple fully connected multilayer perceptron neural network layers and finally by a sigmoid layer to generate the decision of whether a given instance of SDN-SGC network modeled by G t is under attack or not.
1) Graph convolution (GCN) layers: Our implementation of graph convolutional layers is based on the implementation of GCN proposed in [10]. For a graph G t with weighted adjacency matrix W t adj and node attribute matrix W t V , each graph convolutional layer outputs a matrix containing hidden node level representations termed as a hidden feature matrix H, which is defined as
where Θ is the matrix of learnable parameters for a given graph convolutional layer, f (.) is an activation function, and Z is defined as
The weighted adjacency matrix, ˜︂ W t adj , is defined as
where Calculate H using Eq. 1, 2 and 3 for each GCN layer.
Obtain g t by combining H from multiple GCN layers using graph pooling. The main tools used in spectral clustering are Graph Laplacian (L) matrices, which are developed based on spectral graph theory. Normalized Graph Laplacian of a graph G t with weighted adjacency matrix W t adj and weighted degree diagonal matrix W t deg is calculated as
where I N ∈ R N ×N is an identity matrix. Eigenvectors and Eigenvalues obtained through spectral decomposition of L t are used in conjunction with traditional k-means algorithm to divide compromised PMUs and normal PMUs in the SDN-SGC network. We classify all the PMUs in SG into 3 groups as following:
• Primary victims (V pv ) -Set of PMUs which are directly targeted during DDoS attacks. • Secondary victims (V sv ) -Set of PMUs which are connected to primary victims (1-hop neighbors). These are of interest to us as DDoS attacks on primary victims have considerable impact on PMUs connected to them. • Normal PMUs (V n ) -Set of PMUs which are neither primary victims nor secondary victims in the SG. The pseudocode of the DDoS identification phase of the proposed GLASS framework for a time step t is presented in Procedure 2. The value of k is set to be three as we want to identify three groups of PMUs namely primary victims, secondary victims and normal PMUs through DDoS identification phase. After identifying three groups of PMUs, we calculate mean network performance using either average throughput
) of each group and use their values to label all three groups. The intuition is that attacked PMUs would usually have higher performance deterioration than normal PMUs.
Calculate Graph Laplacian L t using Eq. 4
3:
Compute first k eigenvectors u 1 , ..., u k of L t corresponding to k of its smallest eigenvalues 4:
Form U ∈ R N ×k containing vectors u 1 , ..., u k
For i = 1, 2, ..., N , let a i ∈ R k be the vector corresponding to i th row of U 6:
Network performance statistics (i.e. transmission delays, and throughput) are generated using mininet and extensions to emulate the communication layer of IEEE 118-bus power grid system that commonly uses IEEE C37.118.2 or IEC 61850 over TCP/IP communication schemes. In this environment, anomalous network traffic (i.e. DoS attack) is generated using the tools, such as hping3 [7], to initiate TCP flooding attacks. In general, the packet arrival rate for the victim node is increased during the periods where DoS attacks take place. This action consumes network resources on the victim node resulting in an increase in transmission delays and decrease in throughput. Network performance metrics are recorded using network monitoring tools such as sflow-rt, t-shark, or wireshark and the open network operating system (ONOS) is used as the SDN controller. The implementation of the proposed GLASS framework and
In this data set, DDoS attacks are simulated for a SDN-SGC network. In a total of 3000 (T ) time steps (each time step constitutes a data sample which contains 118 data points, one for each bus) considered, DDoS attacks are introduced in 50% of the total samples, with each attack lasting for ten consecutive samples. The resultant data set (overall 354,000 data points) of this type has half the samples with DDoS attacks and another half with normal network performance samples. While training, we use same number of normal and attacked samples to train the GCN model to reduce class wise bias. In each of the attacked samples, a variation of (i.e. 1, 5, 10) buses were randomly chosen to be attacked. The network performance statistics generated for the communication layer were based on the M/M/c queue, i.e., c ≥ 1, where packet arrivals were modelled after Poisson distribution and transmission delays were inherently modelled after the exponential distribution. The throughput is measured as the actual amount of information (i.e. network packets) that can flow through a connection at a given time, and transmission delay is measured as the time taken for packet to be transmitted between two PMUs.
The SDN-SGC network considered in this case study is based on IEEE 118-bus system. It contains 118 nodes (1 for each bus) and 186 network links (1 for each branch), with connections between them as considered in [16]. The performance of the proposed DDoS detection phase of the GLASS framework is evaluated using popular classification metrics [17] such as Accuracy, Precision, Recall and F1-score, while we define two metrics namely True Compromised Ratio (TCR) and All Compromised Ratio (ACR) for evaluating performance of DDoS identification phase of GLASS framework as the former popular metrics doesn't provide complete picture for the performance of an unsupervised learning algorithm such as spectral clustering. True Compromised Ratio (TCR) is calculated as the percentage ratio of compromised nodes identified correctly in G t . All Compromised Ratio (ACR) is calculated as the percentage ratio of identified nodes truly belonging to the set of true compromised nodes in G t .
The mean (µ) and standard deviation (σ sd ) values of accuracy, precision, recall and F1-score summarized for 10 different sets of training and testing data, and the mean (µ) and standard deviation (σ sd ) values of TCR and ACR summarized ∀G t where t = 1 : T test are presented in Table I. |V pv | in Table I indicates number of PMUs directly targeted during DDoS attacks. A total of 3000 (T ) graphs (354,000 data points) were used for implementing steps mentioned in Procedures 1 and 2. The node attribute matrix is formed using average transmission delay associated with PMUs in the network. The GCN model trained during the detection phase is formed by 2 graph convolution layers each with 64 units and dropout of 0.2 to reduce the chance of overfitting, 2 fully connected layers with 32 and 16 units, and a sigmoid layer with all the layers containing ReLu activation function. The model is trained for 50 epochs with repeated stratified k-fold (5 folds, 2 repeats) technique. We have tested our framework for a variety of attack scenarios by considering low and high attack severity levels, and the number of directly attacked PMUs (primary victims) varying among 1,5 and 10. The values in Table I show that the proposed GLASS framework detects whether a given SDN-SGC network is under any DDoS attacks with high accuracy, precision, recall and F1-score, and also correctly identifies the compromised PMUs with high TCR and ACR values for all the attack scenarios.
Network traffic/performance statistics collected by third party monitoring tools are stored in a database (InfluxDB, AWS, etc.) for analysis and/or extracted by a separate controller [18] tasked with hosting network security applications, like the proposed GLASS framework. Mitigation is applied by sending updated flow policies to the main SDN controller's northbound interface for reconfiguring the flow tables in switches. The controller limits the flow of TCP SYN packets to the compromised nodes, which improves the network performance considerably [19].
Figures 2 and3 shows the variation of network performance in terms of average throughput and average transmission delay for normal traffic to the nodes, for compromised nodes during DDoS attacks and after mitigation is applied to the compromised nodes, as identified by GLASS framework. The average throughput decreases drastically (4% of the normal traffic level) when subjected to DDoS attacks, but is improved (84% of the normal traffic level) after the mitigation policy is applied to the compromised nodes identified by the GLASS framework. Similarly, average transmission delay increases drastically (1415% of normal traffic delay) during DDoS attacks but is decreased closer to pre-attack levels (121% of normal traffic level) through the mitigation policy assisted by GLASS framework. V. CONCLUSIONS This paper presents GLASS: A graph learning approach to detect and identify DDoS attacks in SDN-SGC system. The proposed framework works in two phases namely, DDoS detection and DDoS identification. DDoS detection employs graph convolutional networks designed for graph level classification tasks to detect whether a given SDN-SGC network is under any DDoS attacks. If DDoS attacks are detected from the first phase, DDoS identification phase which employs spectral clustering is then used to identify compromised entities in the network so that mitigation policies can be applied to improve the network performance degraded due to DDoS attacks. Experimental results show that the use of proposed GLASS framework resulted in improvement of network performance statistics such as average throughput and average transmission delay. The GLASS framework learns latent representations in the network caused due to introduction of DDoS attacks through supervised graph based deep learning and unsupervised spectral graph clustering approaches. In future work, the GLASS framework will be extended to learn latent representations in the network from unintentional factors like system failures (component malfunction) or intentional cyber attacks, such as False Data Injections, Jamming, and Man-In-The-Middle attack etc.