Hierarchical Clustering for Anomalous Traffic Conditions Detection in Power Substations

Agrupamiento jerárquico para la detección de condiciones de tráfico anómalo en subestaciones de energía

dc.creatorLeal Piedrahita, Erwin Alexander
dc.date2019-11-12
dc.identifierhttps://revistas.unimilitar.edu.co/index.php/rcin/article/view/4236
dc.identifier10.18359/rcin.4236
dc.descriptionThe IEC 61850 standard has contributed significantly to the substation management and automation process by incorporating the advantages of communications networks into the operation of power substations. However, this modernization process also involves new challenges in other areas. For example, in the field of security, several academic works have shown that the same attacks used in computer networks (DoS, Sniffing, Tampering, Spoffing among others), can also compromise the operation of a substation. This article evaluates the applicability of hierarchical clustering algorithms and statistical type descriptors (averages), in the identification of anomalous patterns of traffic in communication networks for power substations based on the IEC 61850 standard. The results obtained show that, using a hierarchical algorithm with Euclidean distance proximity criterion and simple link grouping method, a correct classification is achieved in the following operation scenarios: 1) Normal traffic, 2) IED disconnection, 3) Network discovery attack, 4) DoS attack, 5) IED spoofing attack and 6) Failure on the high voltage line. In addition, the descriptors used for the classification proved equally effective with other unsupervised clustering techniques such as K-means (partitional-type clustering), or LAMDA (diffuse-type clustering).
dc.descriptionEl estándar IEC 61850 ha contribuido notablemente con el proceso de gestión y automatización de las subestaciones, al incorporar las ventajas de las redes de comunicaciones en la operación de las subestaciones de energía. Sin embargo, este proceso de modernización también involucra nuevos desafíos en otros campos. Por ejemplo, en el área de la seguridad, diversos trabajos académicos han puesto en evidencia que la operación de una subestación también puede ser comprometida por los mismos ataques utilizados en las redes de cómputo (DoS, Sniffing, Tampering, Spoffing entre otros). Este artículo evalúa la aplicabilidad de los algoritmos de agrupamiento no supervisado de tipo jerárquico y el uso de descriptores de tipo estadístico (promedios), en la identificación de patrones de tráfico anómalo en redes de comunicación para subestaciones eléctricas basadas en el estándar IEC 61850. Los resultados obtenidos demuestran que, utilizando un algoritmo jerárquico con criterio de proximidad distancia Euclidiana y método de agrupación vínculo simple, se logra una correcta clasificación de los siguientes escenarios de operación: 1) Tráfico normal, 2) Desconexión de dispositivo IED, 3) Ataque de descubrimiento de red, 4) Ataque de denegación de servicio, 5) Ataque de suplantación de IED y 6) Falló en la línea de alta tensión. Además, los descriptores utilizados para la clasificación demostraron ser robustos al lograrse idénticos resultados con otras técnicas de agrupamiento no supervisado de tipo particional como K-medias o de tipo difuso como LAMDA (Learning Algorithm Multivariable and Data Analysis).
dc.formatapplication/pdf
dc.formattext/xml
dc.languageeng
dc.publisherUniversidad Militar Nueva Granada
dc.relationhttps://revistas.unimilitar.edu.co/index.php/rcin/article/view/4236/4082
dc.relationhttps://revistas.unimilitar.edu.co/index.php/rcin/article/view/4236/4251
dc.relation/*ref*/H. Farhangi, "The path of the smart grid," IEEE power and energy magazine, vol. 8, no. 1, pp. 18-28, 2009. https://doi.org/10.1109/MPE.2009.934876
dc.relation/*ref*/R.H. Khan & J.Y. Khan, "A comprehensive review of the application characteristics and traffic requirements of a smart grid communications network," Computer Networks, vol. 57, no. 3, pp. 825-845, 2013. https://doi.org/10.1016/j.comnet.2012.11.002
dc.relation/*ref*/TC57, I. E. C. "IEC 61850: Communication networks and systems for power utility automation," International Electrotechnical Commission Std, vol. 53, pp. 54, 2010.
dc.relation/*ref*/M.T.A. Rashid, S. Yussof, Y. Yusoff, & R. Ismail, "A review of security attacks on IEC61850 substation automation system network," in IEEE Proceedings of the 6th International Conference on Information Technology and Multimedia November, 2014, pp. 5-10. https://doi.org/10.1109/ICIMU.2014.7066594
dc.relation/*ref*/K. Choi, X. Chen, S. Li, M. Kim, K. Chae, & J, Na, "Intrusion detection of NSM based DoS attacks using data mining in smart grid". Energies, vol. 5, no. 10, pp. 4091-4109, 2012. https://doi.org/10.3390/en5104091
dc.relation/*ref*/U.K. Premaratne, J. Samarabandu, T.S. Sidhu, R. Beresh, & J.C. Tan, "An intrusion detection system for IEC61850 automated substations." IEEE Transactions on Power Delivery, vol. 25, no. 4, pp. 2376-2383, 2010. https://doi.org/10.1109/TPWRD.2010.2050076
dc.relation/*ref*/J. Hoyos, M. Dehus, & T.X. Brown, "Exploiting the GOOSE protocol: A practical attack on cyber-infrastructure," In IEEE Globecom Workshops, 2012 pp. 1508-1513. https://doi.org/10.1109/GLOCOMW.2012.6477809
dc.relation/*ref*/J. Hong, C.-C. Liu, & M. Govindarasu, "Detection of cyber intrusions using network-based multicast messages for substation automation," in Innovative Smart Grid Technologies Conference (ISGT), pp. 1-5.
dc.relation/*ref*/N. Kush, E. Ahmed, M. Branagan, & E. Foo, "Poisoned goose: exploiting the goose protocol," in Proceedings of the Twelfth Australasian Information Security Conference, 2014, pp. 17-22.
dc.relation/*ref*/P.K. Chan, M.V. Mahoney & M.H. Arshad, "Learning rules and clusters for anomaly detection in network traffic," in Managing Cyber Threats, 2005, pp. 81-99. https://doi.org/10.1007/0-387-24230-9_3
dc.relation/*ref*/J. A. Gallardo, Análisis de datos multivariantes, [Online]. Available: http://www.ugr.es/~gallardo/, accessed July, 31, 2019.
dc.relation/*ref*/G. Münz, S. Li, & G. Carle, "Traffic anomaly detection using k-means clustering," in GI/ITG Workshop MMBnet, 2007, pp. 13-14.
dc.relation/*ref*/D. Liu & C.H. Lung, "P2p traffic identification and optimization using fuzzy c-means clustering," in IEEE International Conference on Fuzzy Systems (FUZZ), 2011, pp. 2245-2252.https://doi.org/10.1109/FUZZY.2011.6007613
dc.relation/*ref*/C.J. Dietrich, C. Rossow, & N. Pohlmann, "Cocospot: Clustering and recognizing botnet command and control channels using traffic analysis," Computer Networks, vol. 57, no. 2, pp. 475-486, 2013. https://doi.org/10.1016/j.comnet.2012.06.019
dc.relation/*ref*/P. Narang, C. Hota, & V. Venkatakrishnan, "Peershark: flow-clustering and conversation-generation for malicious peer-to-peer traffic identification," EURASIP Journal on Information security, vol. 2014, no. 1, p. 15, 2014. https://doi.org/10.1186/s13635-014-0015-3
dc.relation/*ref*/P. Velarde-Alvarado, C. Vargas-Rosales, R. Martinez-Pelaez, H. ToralCruz, & A.F. Martinez-Herrera, "An unsupervised approach for traffic trace sanitization based on the entropy spaces," Telecommunication Systems, vol. 61, no. 3, pp. 609-626, 2016. https://doi.org/10.1007/s11235-015-0017-6
dc.relation/*ref*/T.P. Fries, "Classification of network traffic using fuzzy clustering for network security," in Industrial Conference on Data Mining, 2017, pp. 278-285. https://doi.org/10.1007/978-3-319-62701-4_22
dc.relation/*ref*/T. Bajtoš, A. Gajdoš, L. Kleinová, K. Luˇcivjanská, & P. Sokol, "Network intrusion detection with threat agent profiling," Security and Communication Networks, 2018.
dc.relation/*ref*/W. Wu, J. Alvarez, C. Liu, & H.M. Sun, "Bot detection using unsupervised machine learning," Microsystem Technologies, vol. 24, no. 1, pp. 209-217, 2018.
dc.relation/*ref*/R. Ierusalimschy, L.H. De Figueiredo, & W.C. Filho, "Lua-an extensible extension language," Software: Practice and Experience, vol. 26, no. 6, pp. 635-652, 1996.
dc.relation/*ref*/J.C. Gower, "Some distance properties of latent root and vector methods used in multivariate analysis," Biometrika, vol. 53, no. 3-4, pp. 325-338, 1966.
dc.relation/*ref*/H. Steinhaus, "Sur la division des corp materiels en parties," Bull. Acad. Polon. Sci, vol. 1, no. 804, p. 801, 1956.
dc.relation/*ref*/J. Aguilar-Martin & R.L. De Mantaras, "The process of classification and learning the meaning of linguistic descriptors of concepts," Approximate reasoning in decision analysis, vol. 1982, pp. 165-175, 1982.
dc.rightsDerechos de autor 2019 Ciencia e Ingeniería Neogranadina
dc.sourceCiencia e Ingenieria Neogranadina; Vol. 30 No. 1 (2020); 75-88
dc.sourceCiencia e Ingeniería Neogranadina; Vol. 30 Núm. 1 (2020); 75-88
dc.sourceCiencia e Ingeniería Neogranadina; v. 30 n. 1 (2020); 75-88
dc.source1909-7735
dc.source0124-8170
dc.subjectHierarchical
dc.subjectclustering
dc.subjectunsupervised
dc.subjectIEC 61850
dc.subjecttraffic detection
dc.subjectpower substation
dc.subjectJerárquico
dc.subjectagrupamiento
dc.subjectaprendizaje no supervisado
dc.subjectIEC 61850
dc.subjectdetección de tráfico
dc.subjectsubestación eléctrica
dc.titleHierarchical Clustering for Anomalous Traffic Conditions Detection in Power Substations
dc.titleAgrupamiento jerárquico para la detección de condiciones de tráfico anómalo en subestaciones de energía
dc.typeinfo:eu-repo/semantics/article
dc.typeinfo:eu-repo/semantics/publishedVersion
dc.typetext


Este ítem pertenece a la siguiente institución