AE-LSTM Based Anomaly Detection System for Communication Over DNP 3.0

Abstract

Energy Management System (EMS) communicates with power plants and substations to maintain the reliability and efficiency of power supplies. EMS collects and monitors data from these sources and controls power flow through commands to ensure uninterrupted power supply, frequency and voltage maintenance, and power recovery in the event of a power outage. EMS works in a Distributed Network Protocol (DNP) 3.0-based network environment that is considered secure due to its unique security features and communication methods. However, cyberattacks exploiting the vulnerability of the DNP 3.0 protocol can manipulate the power generation output, resulting in serious consequences such as facility malfunction and power outages. To address this issue, this paper identifies security threats in power system networks, including DNP 3.0, and proposes an AI-based anomaly detection system based on DNP 3.0 network traffic. Existing network traffic target rule-based detection methods and signature-based detection methods have defects. We propose an AI-based anomaly detection system to compensate for defects in existing anomaly detection methods and perform efficient anomaly detection. To evaluate the performance of the AI-based anomaly detection system proposed in this paper, we used a dataset containing normal network traffic and nine types of attack network traffic obtained from the DNP 3.0 communication testbed, and experiments showed 99% accuracy, 98% TPR, and 1.6% FPR, resulting in 99% F-1 score. By implementing these security measures, power system network environments, including EMS, can be better protected against cyber threats.