Keywords

1 Introduction

During the last years power supply was subject to fundamental changes. In the course of the energy revolution the percentage of fossil fuels and nuclear power decreases and in return the percentage of renewable energies, such as wind and sun, increases. Therefore the energy production is more and more decentralized and the availability changes from static to dynamic. In this context not only a few actors of the infrastructure, e.g. the energy service provider, produce power but also private customers are able to act as producers by installing their own power supplies, e.g. photovoltaics, at their houses. It is also possible to store the power, e.g. in accumulators of electric cars. The former consumer acts as a producer and energy provider as well. We call him Prosumer.

To face these new challenges the SG infrastructure concept was established. Due to the increased number of producers it has to be ensured, that the network is not damaged by big deviations of power. In this context detailed consumption data of the Prosumers are recorded and sent by the smart meters to the energy service provider. This recorded data threatens the privacy of the Prosumer. The SG infrastructure is additionally threatened by external attackers [16, 19].

It is eligible, to detect these attacks by suitable IDS considering Prosumer’s privacy. In this paper a new approach is introduced.

2 Related Work

We investigated the number of available publications searched by Key Word and Key Word combinations. The queries were based on the IEEE Xplore® Digital Library. We think that this database is a quite important one for the research on SG. Nevertheless this restriction is a drawback of our work. In future analyses the search should be extended to other libraries such as Springer or Google Scholar.

2.1 Quantitative Analysis

The results gives us a first impression about the focus of actual research on SG and are illustrated in Tables 1 and 2.

Table 1. Hits per Key Word (IEEE Xplore® digital library).
Full size table
Table 2. Hits per Key Word combinations (IEEE Xplore® digital library).
Full size table

The tables show that Smart Grid and privacy with over 10, 000 and 20, 000 hits respectively are important fields of research besides security.

To find interconnections between different Key Words, we searched for combinations of these terms, Table 2 shows hits on such combinations.

Fig. 1.
figure 1

Closeness Centrality of selected survey papers

Full size image

It could be concluded that the research on Smart Grid is mainly focused on security, but privacy is discussed less. Nonetheless protection of privacy in the context of SG is well analysed by many publications [8, 10, 15, 18, 23, 25], IDS and attack vectors on SG are part of the current research [2, 3, 21, 26, 27] as well. The combination of the Key Words Smart Grid, Intrusion Detection and Privacy yields just five publications. It seems that especially privacy in connection with Intrusion Detection for the Smart Grid is not considered sufficiently. IDS aggregate and analyse a lot of data [6] and in addition this data is highly privacy relevant. The consumption data reveals details about the daily routine, consumer behaviour and habits of the residents [12, 22, 23]. However it seems that hitherto IDS is primarily used to protect the energy service provider not the Prosumer. Therefore we think that research with regard to the Prosumer’s privacy should be intensified.

2.2 Qualitative Analysis by Directed Graphs

To measure the impact of single publications we generated a network with directed graphs that shows the interconnections between different papers and their references. Thereby we tried to verify the assumptions we made above. For this purpose the results were processed to more meaningful graphs. We used the “Closeness Centrality” metric, which measures how far a node is away from other ones. A high value means that the publication and their references use lot of third party references. This suggests that they are survey papers and it is confirmed by a close look. These papers are represented by the nodes shown in Fig. 1. The node size visualises the closeness centrality value. The red coloured nodes represent publications that are related to privacy. As you can see, there is just one node of relevance, which is related to the topic privacy. This affirms our assumptions that privacy is not yet sufficiently investigated.

3 NILM Based IDS

NILM was first proposed by Hart [14] in the year 1989. The idea behind this concept is to use only one measurement device to gather consumption data of the whole household. It will be described in Sect. 3.3.

First we will introduce the infrastructure, the interconnection from a household with the SG itself and the IDS components in detail.

3.1 The Smart Meter Intrustion Detection Infrastructure

In Sect. 2 we have shown that privacy seems not to be an important part for IDS in the SG. The suggested concepts only analyse network traffic [29] and gather information outside the household [2]. Energy fraud and malicious devices which produce unusual consumption of energy are not detected. Salinas et al. [27] introduced an interesting concept for privacy-preserving energy theft detection, where the neighbourhood is involved in the fraud detection. But this concept does not consider the attacker inside a household.

Our approach is a privacy friendly inhouse IDS and was inspired by this idea. We want to reach this goal by developing a decentralized IDS where all relevant energy consumption data is aggregated by a device inside the household. This device should act as central AMS, illustrated in Fig. 2. Every available appliance inside a household is therefore known by the AMS, which is also the SM. Thus it can be avoided that sensitive data is permanently transferred to the energy service provider. The Prosumers produces and consumes energy which is depicted as a bidirectional energy flow in the figure. The energy flows through the SM and also bidirectional into the grid. Only the energy flow from the ESP is unidirectional. The data communication between every party is always bidirectional and should be encrypted in accord with the BSI [4].

All appliances consume energy and hence are directly connected with the SM over the powerline. Which leads to that the SM knows the energy consumption behaviour of the household. Inside the SM the following components should be included as it is recommended by the BSI:

  • Some kind of user interaction component, where the consumer can monitor his energy consumpiton, ideally as historical graph.

  • A TPM which implements a random generator and securely handles the private keys for decryption and signing.

  • A communication module which handles the dataflow between the parties.

Fig. 2.
figure 2

Exemplary depiction of a Smart Meter Intrustion Detection Infrastructure. (Some parts of the graphic are from Marekich (Wikipedia) under the CC BY-SA 3.0 licence)

Full size image

Our approach is to include the IDS and a response mechanism inside the SM. The user now has the possibility to get Informations about security incidents and react on them. How the data is collected and processed will be described in Sect. 3.3. The response system could be an LCD panel, a SMS or E-Mail sender, a web interface or an API where a third party device (e.g. Smartphone App) can connect to.

To detect, categorize and manage all energy consuming household appliances, an analogue technique like NILM could be used. Every device is identified by its individual energy consumption signature. The idea is, when every appliance can be identified inside a household and the normal energy consumption behaviour of a device or the whole system is known, an irregular acting device can be identified. For example a possible attack on an SG could be that high energy consuming devices (e.g. a air conditioning) in a specific region are compromised by a virus. What if all these devices are activated at the same time? A sharply rising energy consumption in this region would be the consequence. If we have a large region and the peak is high enough or the consumption goes over a long period of time, the grid structure could be overstressed and damaged. The data link communication between the malicious device and an attacker can be disguised in the normal internet traffic or over a encrypted communication. But an AMS with an integrated IDS could detect such an irregular energy consumption and counteract it, because an attacker can not hide the irregular energy consumption from the SM.

Fig. 3.
figure 3

Intrusion detection system information flow diagram [7].

Full size image
Fig. 4.
figure 4

Intrusion detection system module details [5]

Full size image

3.2 IDS Structure

Figure 3 shows examplary the information flow for the IDS structure. A system training phase is nessesary before the system can be deployed. A preparation module with a initial dataset trains the IDS. When this phase is finished, the protected system is monitored by an IDS Module which is inside the SM. For every incident the respone and notification module is triggered. The user can now interact with the system and give response in an appropriate manner. To deal with false positives or false negatives a feedback channel to the preparation module could be used to adjust the IDS. A detailed structure of the IDS Module itself is shown in Fig. 4. The IDS Knowledge Database contains the normal behaviour pattern of the household and the appliances. It provides the Sensor with information about the normal and abnormal behaviour. A second database (IDS Configuration Database) could contain IDS specific configuration information (e.g. in wich time frame the system should be active). The Attack Response Module was already described.

Fig. 5.
figure 5

Intrusion detection system policies [20].

Full size image

Figure 5 gives an overview about the policy structure from the IDS. The structure is seperated in three parts.

Information Collection

  • Event / Consumption Generator:

    The generator is the physical device which collects the real world data. It uses the Information Collecting Policy to decide how the information and which information should be collected.

  • Consumption Events:

    The Consumption Events are the resulting data which are generated by the Event / Consumption Generator. The events are handled by a storage process and stored in a central location such as a database.

  • Information Collecting Policy:

    The Information Collecting Policy defines how information and which information will be collected. For example the collection intervall which characterizes the period between every collected energy consumption measurement. An external information such as meterological information could also be collected, for example the ambient temperature and general weather information. And of course the timestemp, when the information is collected.

Detection

  • IDS Sensor:

    The IDS Sensor analyse the preserved information and tries to detect suspicious or abnormal behaviour. How the collected data is processed is defined by the Detection Policy. Also additional System Information can be considered for the data analysis by the sensor.

  • System Information:

    To support the IDS Sensor during the detection process and the to decide if an anomaly is an attack or a false positive / false negative, additional information for example actual meterological information like the temperature could be used. The System Information privide such kind of information.

  • Detection Policy:

    The Detection Policy specifies to which extent the energy flow will be monitored and stored. The Detection Policy could also define a value how detailed the collected data is analysed. The policy could also define which algorithm (for example which ML algorithm) is used to process the data. The policy also contains information how the determined results should be interpreted.

Response

  • Attack Response Module:

    This module contacts the Prosumer and informs him or her about an incident. The user can now react on this event and can decide the next steps.

  • Response Policy:

    The policy defines how, when and who gets informed about incidents. For example just the Prosumer gets informed or also a centralised database as descriped in Sect. 4. The information to the user could be commited over SMS, as an E-Mail, over a web interface or an API and a connected Smartphone Application.

The policies could be connected to attach conditions or to sum them up.

3.3 How NILM Works

As described before, every device should be identified and be known by the sytem. At least an abnormal behaviour should be detected. NILM is a concept which can fulfill these requirement. The idea of NILM is over 25 years old and there were many different NILM algorithms and concepts developed since.

We will give a short overview about NILM and how it works. The functionality can be classified in three main principles:

  • In the first step, characteristic consumption or production data of appliances has to be collected. This means that the overall energy consumption of a household is measured and collected. The collection can be realised by external hardware or within a smart meter. The actual research distinguishes between two different collection methods, the high-frequency and low-frequency data collection. Though there is no exact definition of high-frequency and low-frequency [13, 24, 30, 31].

  • In the second step, collected raw data has to be processed. This process is called feature extraction. Its goal is to generate an individual signature for every device [31]. A signature should be unique and describes a characteristic temporal change of consumption of each device. As a data base the real power and reactive power for a device can be used [1, 9, 28].

  • After the raw data is analysed and signatures are generated, classification methods are used to disaggregate appliances in a third step. The classification can be separated in supervised and unsupervised classification. For the supervised method, labelled datasets are produced. This means that every generated signature is related to a device designation label which is set manually. In contrast, the unsupervised classification needs no external influence. This means that the device designation labels are already present in a pre-delivered database [11], are generated from the real power and reactive power plot or use a HMM and variations from this model, for example CFHMM [17].

Fig. 6.
figure 6

Example of an energy consumption graph. The red line shows the overall consumption, the other colours show devices inside a household (Color figure online).

Full size image
Fig. 7.
figure 7

Central incident database.

Full size image

4 Next Steps

Figure 6 depicts an example consumption trace. The red coloured graph shows the overall consumption of a household over a period of time. This trace is known by the SM. The other coloured traces symbolise the energy consumption of appliances inside a household and are inaccessible for the SM. The accumulated consumption of every device inside a household is represented by the overall consumption. If we are able to determine the consupmtion of every appliance, we are able to detect anomalies. Our next step will be the implementation of AMS, based on NILM technology. We want to find out which NILM concept works best for our IDS idea. Some NILM algorithms and concepts are based on ML algorithms. Our next research steps will go in this direction. We will implement, train and test different ML concepts, based on energy consumption traces gathered in the real world.

For future ideas, the decentralised IDS could be combined with a centralised evaluation and analysis system, for example to detect false positives (Fig. 7). To come back to the air conditioning example, this could also be a false positive, caused by an unusual warm day. If the decentralised IDS of every household communicates incidents to a centralised system, false positives could be detected without revealing privacy relevant consumption data.