False power consumption data injected from compromised
smart meters in Advanced Metering Infrastructure
(AMI) of smart grids is a threat that negatively affects both
customers and utilities. In particular, organized and stealthy
adversaries can launch various types of data falsification attacks
from multiple meters using smart or persistent strategies. In this
paper, we propose a real time, two tier attack detection scheme
to detect orchestrated data falsification under a sophisticated
threat model in decentralized micro-grids. The first detection
tier monitors whether the Harmonic to Arithmetic Mean Ratio of
aggregated daily power consumption data is outside a normal
range known as safe margin. To confirm whether discrepancies
in the first detection tier is indeed an attack, the second detection
tier monitors the sum of the residuals (difference) between the
proposed ratio metric and the safe margin over a frame of multiple
days. If the sum of residuals is beyond a standard limit range,
the presence of a data falsification attack is confirmed. Both the
‘safe margins’ and the ‘standard limits’ are designed through
a ‘system identification phase’, where the signature of proposed
metrics under normal conditions are studied using real AMI
micro-grid data sets from two different countries over multiple
years. Subsequently, we show how the proposed metrics trigger
unique signatures under various attacks which aids in attack
reconstruction and also limit the impact of persistent attacks.
Unlike metrics such as CUSUM or EWMA, the stability of the
proposed metrics under normal conditions allows successful real
time detection of various stealthy attacks with ultra-low false
alarms.
more »
« less
This content will become publicly available on June 1, 2024
Detection of False Data Injection in Smart Water Metering Infrastructure
Smart water metering (SWM) infrastructure collects
real-time water usage data that is useful for automated billing,
leak detection, and forecasting of peak periods. Cyber/physical
attacks can lead to data falsification on water usage data. This
paper proposes a learning approach that converts smart water
meter data into a Pythagorean mean-based invariant that is
highly stable under normal conditions but deviates under attacks.
We show how adversaries can launch deductive or camouflage
attacks in the SWM infrastructure to gain benefits and impact
the water distribution utility. Then, we apply a two-tier approach
of stateless and stateful detection, reducing false alarms without
significantly sacrificing the attack detection rate. We validate our
approach using real-world water usage data of 92 households
in Alicante, Spain for varying attack scales and strengths and
prove that our method limits the impact of undetected attacks and
expected time between consecutive false alarms. Our results show
that even for low-strength, low-scale deductive attacks, the model
limits the impact of an undetected attack to only 0.2199375 pounds and
for high-strength, low-scale camouflage attack, the impact of an
undetected attack was limited to 1.434375 pounds.
more »
« less
- Award ID(s):
- 2030611
- NSF-PAR ID:
- 10434257
- Date Published:
- Journal Name:
- IEEE International Conference on Smart Computing Workshops
- ISSN:
- 2693-8332
- Format(s):
- Medium: X
- Sponsoring Org:
- National Science Foundation
More Like this
-
-
null (Ed.)Spurious power consumption data reported from compromised meters controlled by organized adversaries in the Advanced Metering Infrastructure (AMI) may have drastic consequences on a smart grid’s operations. While existing research on data falsification in smart grids mostly defends against isolated electricity theft, we introduce a taxonomy of various data falsification attack types, when smart meters are compromised by organized or strategic rivals. To counter these attacks, we first propose a coarse-grained and a fine-grained anomaly-based security event detection technique that uses indicators such as deviation and directional change in the time series of the proposed anomaly detection metrics to indicate: (i) occurrence, (ii) type of attack, and (iii) attack strategy used, collectively known as attack context . Leveraging the attack context information, we propose three attack response metrics to the inferred attack context: (a) an unbiased mean indicating a robust location parameter; (b) a median absolute deviation indicating a robust scale parameter; and (c) an attack probability time ratio metric indicating the active time horizon of attacks. Subsequently, we propose a trust scoring model based on Kullback-Leibler (KL) divergence, that embeds the appropriate unbiased mean, the median absolute deviation, and the attack probability ratio metric at runtime to produce trust scores for each smart meter. These trust scores help classify compromised smart meters from the non-compromised ones. The embedding of the attack context, into the trust scoring model, facilitates accurate and rapid classification of compromised meters, even under large fractions of compromised meters, generalize across various attack strategies and margins of false data. Using real datasets collected from two different AMIs, experimental results show that our proposed framework has a high true positive detection rate, while the average false alarm and missed detection rates are much lesser than 10% for most attack combinations for two different real AMI micro-grid datasets. Finally, we also establish fundamental theoretical limits of the proposed method, which will help assess the applicability of our method to other domains.more » « less
-
Falsified data from compromised Phasor Measurement Units (PMUs) in a smart grid induce Energy Management Systems (EMS) to have an inaccurate estimation of the state of the grid, disrupting various operations of the power grid. Moreover, the PMUs deployed at the distribution layer of a smart grid show dynamic fluctuations in their data streams, which make it extremely challenging to design effective learning frameworks for anomaly based attack detection. In this paper, we propose a noise resilient learning framework for anomaly based attack detection specifically for distribution layer PMU infrastructure, that show real time indicators of data falsifications attacks while offsetting the effect of false alarms caused by the noise. Specifically, we propose a feature extraction framework that uses some Pythagorean Means of the active power from a cluster of PMUs, reducing multi-dimensional nature of the PMU data streams via quick big data summarization. We also propose a robust and noise resilient methodology for learning thresholds based on generalized robust estimation theory of our invariant feature. We experimentally validate our approach and demonstrate improved reliability performance using two completely different datasets collected from real distribution level PMU infrastructures.more » « less
-
Cyber-physical systems (CPS) are susceptible to physical attacks, and researchers are exploring ways to detect them. One method involves monitoring the system for a set duration, known as the time-window, and identifying residual errors that exceed a predetermined threshold. However, this approach means that any sensor attack alert can only be triggered after the time-window has elapsed. The length of the time-window affects the detection delay and the likelihood of false alarms, with a shorter time-window leading to quicker detection but a higher false positive rate, and a longer time-window resulting in slower detection but a lower false positive rate. While researchers aim to choose a fixed time-window that balances a low false positive rate and short detection delay, this goal is difficult to attain due to a trade-off between the two. An alternative solution proposed in this paper is to have a variable time-window that can adapt based on the current state of the CPS. For instance, if the CPS is heading towards an unsafe state, it is more crucial to reduce the detection delay (by decreasing the time-window) rather than reducing the false alarm rate, and vice versa. The paper presents a sensor attack detection framework that dynamically adjusts the time-window, enabling attack alerts to be triggered before the system enters dangerous regions, ensuring timely detection. This framework consists of three components: attack detector, state predictor, and window adaptor. We have evaluated our work using real-world data, and the results demonstrate that our solution improves the usability and timeliness of time-window-based attack detectors.more » « less
-
In cloud computing, it is desirable if suspicious activities can be detected by automatic anomaly detection systems. Although anomaly detection has been investigated in the past, it remains unsolved in cloud computing. Challenges are: characterizing the normal behavior of a cloud server, distinguishing between benign and malicious anomalies (attacks), and preventing alert fatigue due to false alarms. We propose CloudShield, a practical and generalizable real-time anomaly and attack detection system for cloud computing. Cloudshield uses a general, pretrained deep learning model with different cloud workloads, to predict the normal behavior and provide real-time and continuous detection by examining the model reconstruction error distributions. Once an anomaly is detected, to reduce alert fatigue, CloudShield automatically distinguishes between benign programs, known attacks, and zero-day attacks, by examining the prediction error distributions. We evaluate the proposed CloudShield on representative cloud benchmarks. Our evaluation shows that CloudShield, using model pretraining, can apply to a wide scope of cloud workloads. Especially, we observe that CloudShield can detect the recently proposed speculative execution attacks, e.g., Spectre and Meltdown attacks, in milliseconds. Furthermore, we show that CloudShield accurately differentiates and prioritizes known attacks, and potential zero-day attacks, from benign programs. Thus, it significantly reduces false alarms by up to 99.0%.more » « less
