[Paper Review] Multi-Source Data Fusion for Cyberattack Detection in Power Systems

Abhijeet Sahu, Zeyu Mao+5 more|arXiv (Cornell University)|Jan 18, 2021

Network Security and Intrusion Detection69 references4 citations

TL;DR

This paper proposes a multi-source data fusion framework that combines cyber, physical, and security data from a real-time testbed to improve cyberattack detection in power systems. By fusing heterogeneous sensor data with time-synchronized preprocessing and machine learning models, the approach achieves up to a 20% improvement in F1-score over pure cyber-based detection, with co-training semi-supervised learning matching or exceeding supervised performance.

ABSTRACT

Cyberattacks can cause a severe impact on power systems unless detected early. However, accurate and timely detection in critical infrastructure systems presents challenges, e.g., due to zero-day vulnerability exploitations and the cyber-physical nature of the system coupled with the need for high reliability and resilience of the physical system. Conventional rule-based and anomaly-based intrusion detection system (IDS) tools are insufficient for detecting zero-day cyber intrusions in the industrial control system (ICS) networks. Hence, in this work, we show that fusing information from multiple data sources can help identify cyber-induced incidents and reduce false positives. Specifically, we present how to recognize and address the barriers that can prevent the accurate use of multiple data sources for fusion-based detection. We perform multi-source data fusion for training IDS in a cyber-physical power system testbed where we collect cyber and physical side data from multiple sensors emulating real-world data sources that would be found in a utility and synthesizes these into features for algorithms to detect intrusions. Results are presented using the proposed data fusion application to infer False Data and Command injection-based Man-in- The-Middle (MiTM) attacks. Post collection, the data fusion application uses time-synchronized merge and extracts features followed by pre-processing such as imputation and encoding before training supervised, semi-supervised, and unsupervised learning models to evaluate the performance of the IDS. A major finding is the improvement of detection accuracy by fusion of features from cyber, security, and physical domains. Additionally, we observed the co-training technique performs at par with supervised learning methods when fed with our features.

Motivation & Objective

• To address the limitations of conventional rule-based and anomaly-based IDS in detecting zero-day attacks in ICS networks.
• To overcome challenges in fusing heterogeneous data from cyber, physical, and security domains with varying time resolutions and data characteristics.
• To evaluate the impact of data fusion, pre-processing, and machine learning techniques on intrusion detection accuracy in a real-time cyber-physical testbed.
• To demonstrate that inter-domain fusion of cyber and physical features significantly improves detection performance compared to single-domain approaches.
• To validate the feasibility and effectiveness of co-training semi-supervised learning in real-world scenarios with limited labeled data.

Proposed method

• The framework collects real-time data from emulated cyber (Snort, network logs), physical (PMUs, SCADA, smart meters), and security (IDS alerts) sensors in a testbed.
• Data fusion is performed via time-synchronized merging of multi-source data streams, followed by pre-processing including imputation, encoding, and normalization.
• Features are extracted from cyber, physical, and security domains and combined for inter-domain fusion to enrich representation for detection models.
• Supervised, semi-supervised (co-training), and unsupervised (k-means, manifold learning) learning models are trained and evaluated on the fused dataset.
• Manifold learning techniques (LLE, MDS, Isomap, t-SNE, spectral) are applied to assess dimensionality reduction benefits, with performance compared across classifiers.
• Performance is evaluated using F1-score, precision, and recall across multiple classifiers (SVC, k-NN, DT, RF, GNB, BNB, MLP) on attack detection tasks, including False Data Injection and Man-in-the-Middle attacks.

Experimental results

Research questions

• RQ1 Can fusing data from cyber, physical, and security domains improve the accuracy of intrusion detection in power system ICS compared to single-domain detection?
• RQ2 How does data pre-processing, including imputation and encoding, affect the performance of machine learning models in fused cyber-physical intrusion detection?
• RQ3 To what extent does co-training semi-supervised learning perform relative to fully supervised learning when labeled data is limited?
• RQ4 Does manifold learning improve detection accuracy when applied to fused cyber-physical features, or is it primarily useful for visualization?
• RQ5 How do varying data resolutions and time synchronization challenges impact the effectiveness of multi-source data fusion in real-time ICS environments?

Key findings

• Fusing cyber and physical features improved detection F1-score by an average of 15-20% compared to using only cyber features.
• Replacing Snort-based labels with timestamps from intrusion events improved detection performance by 10-20% on average in F1-score.
• Co-training semi-supervised learning performed at par with or better than supervised learning, improving F1-score by up to 5% for certain classifiers like LR and GNB.
• The k-means clustering algorithm demonstrated robustness and accuracy among unsupervised techniques, outperforming other clustering methods in the evaluation.
• Manifold learning techniques such as LLE, MDS, and Isomap did not improve classification accuracy and are therefore not recommended for performance improvement, though they may aid in visualization.
• Decision Tree and Random Forest classifiers showed minimal performance difference when combined with manifold learning, suggesting that such techniques are unnecessary for these models.