@article{Siniosoglou2021b,

title = {A Unified Deep Learning Anomaly Detection and Classification Approach for Smart Grid Environments},

author = {Ilias Siniosoglou and Panagiotis Radoglou-Grammatikis and Georgios Efstathopoulos and Panagiotis Fouliras and Panagiotis Sarigiannidis},

url = {https://www.researchgate.net/publication/351344684_A_Unified_Deep_Learning_Anomaly_Detection_and_Classification_Approach_for_Smart_Grid_Environments},

doi = {10.1109/TNSM.2021.3078381},

year  = {2021},

date = {2021-05-07},

journal = {{IEEE} Transactions on Network and Service Management},

volume = {1},

number = {1},

pages = {1},

abstract = {The interconnected and heterogeneous nature of the next-generation Electrical Grid (EG), widely known as Smart Grid (SG), bring severe cybersecurity and privacy risks that can also raise domino effects against other Critical Infrastructures (CIs). In this paper, we present an Intrusion Detection System (IDS) specially designed for the SG environments that use Modbus/Transmission Control Protocol (TCP) and Distributed Network Protocol 3 (DNP3) protocols. The proposed IDS called MENSA (anoMaly dEtection aNd claSsificAtion) adopts a novel Autoencoder-Generative Adversarial Network (GAN) architecture for (a) detecting operational anomalies and (b) classifying Modbus/TCP and DNP3 cyberattacks. In particular, MENSA combines the aforementioned Deep Neural Networks (DNNs) in a common architecture, taking into account the adversarial loss and the reconstruction difference. The proposed IDS is validated in four real SG evaluation environments, namely (a) SG lab, (b) substation, (c) hydropower plant and (d) power plant, solving successfully an outlier detection (i.e., anomaly detection) problem as well as a challenging multiclass classification problem consisting of 14 classes (13 Modbus/TCP cyberattacks and normal instances). Furthermore, MENSA can discriminate five cyberattacks against DNP3. The evaluation results demonstrate the efficiency of MENSA compared to other Machine Learning (ML) and Deep Learning (DL) methods in terms of Accuracy, False Positive Rate (FPR), True Positive Rate (TPR) and the F1 score.},

keywords = {Anomaly Detection, Auto-encoder, Cybersecurity, Deep  Learning, Generative Adversarial Network, machine learning, Modbus, Smart Grid},

pubstate = {published},

tppubtype = {article}

}

@article{RadoglouGrammatikis2020,

title = {ARIES: A Novel Multivariate Intrusion Detection System for Smart Grid},

author = { P. Radoglou Grammatikis and P. Sarigiannidis and G. Efstathopoulos and E. Panaousis},

url = {https://www.researchgate.net/publication/344176314_ARIES_A_Novel_Multivariate_Intrusion_Detection_System_for_Smart_Grid},

doi = {10.3390/s20185305},

year  = {2020},

date = {2020-01-01},

journal = {Sensors (Basel, Switzerland)},

volume = {20},

number = {18},

abstract = {The advent of the Smart Grid (SG) raises severe cybersecurity risks that can lead to devastating consequences. In this paper, we present a novel anomaly-based Intrusion Detection System (IDS), called ARIES (smArt gRid Intrusion dEtection System), which is capable of protecting efficiently SG communications. ARIES combines three detection layers that are devoted to recognising possible cyberattacks and anomalies against (a) network flows, (b) Modbus/Transmission Control Protocol (TCP) packets and (c) operational data. Each detection layer relies on a Machine Learning (ML) model trained using data originating from a power plant. In particular, the first layer (network flow-based detection) performs a supervised multiclass classification, recognising Denial of Service (DoS), brute force attacks, port scanning attacks and bots. The second layer (packet-based detection) detects possible anomalies related to the Modbus packets, while the third layer (operational data based detection) monitors and identifies anomalies upon operational data (i.e., time series electricity measurements). By emphasising on the third layer, the ARIES Generative Adversarial Network (ARIES GAN) with novel error minimisation functions was developed, considering mainly the reconstruction difference. Moreover, a novel reformed conditional input was suggested, consisting of random noise and the signal features at any given time instance. Based on the evaluation analysis, the proposed GAN network overcomes the efficacy of conventional ML methods in terms of Accuracy and the F1 score.},

keywords = {Cybersecurity, intrusion detection system, machine learning, Modbus, SCADA, Smart Grid},

pubstate = {published},

tppubtype = {article}

}