Industrial Control System Power - Cyber Attacks Detection

Ariel University, Israel || Semester A, 2022

Presentation

Links

Datasets:

https://sites.google.com/a/uah.edu/tommy-morris-uah/ics-data-sets

Website:

http://csariel.xyz:5079/

Docker usage instructions:

The following docker requires a URL to the dataset that you want to check. For example, the dataset should be in the raw format of the attached dataset in the repository Class/binaryAllNaturalPlusNormalVsAttacks/data1.csv, in this case the URL is: https://raw.githubusercontent.com/VictoKu1/IndustrialControlSystemCyberAttackDetectingCourse/master/Class/binaryAllNaturalPlusNormalVsAttacks/data1.csv

1. Upgrade pip :

    pip install --upgrade pip

2. Install requirements for the Jupyter notebook and the UI:

    pip install -r requirements.txt

3. Build the docker image:

    docker build -t attack_detection_ui

4. Run the docker container:

    docker run -it  attack_detection_ui

Datasets

• 2 Classes - The 37 event scenarios were grouped as either an attack (28 events) or normal operations (9 events). The data was drawn from 15 data sets which included thousands of individual samples of measurements throughout the power system for each event type.

• 3 Classes - The 37 event scenarios were grouped into 3 classes: attack events (28 events), natural event (8 events) or “No events” (1 event).

• Multi-class - Each of the 37 event scenarios, which included attack events, natural events, and normal operations, was its own class and was predicted independently by the learners,

Power System Datasets (Dataset 1)

Uttam Adhikari, Shengyi Pan, and Tommy Morris in collaboration with Raymond Borges and Justin Beaver of Oak Ridge National Laboratories (ORNL) have created 3 datasets which include measurements related to electric transmission system normal, disturbance, control, cyber attack behaviors. Measurements in the dataset include synchrophasor measurements and data logs from Snort, a simulated control panel, and relays.

README Description

The power system datasets have been used for multiple works related to power system cyber-attack classification.

• Pan, S., Morris, T., Adhikari, U., Developing a Hybrid Intrusion Detection System Using Data Mining for Power Systems, IEEE Transactions on Smart Grid. doi: 10.1109/TSG.2015.2409775

• Pan, S., Morris, T., Adhikari, U., Classification of Disturbances and Cyber-attacks in Power Systems Using Heterogeneous Time-synchronized Data, IEEE Transactions on Industrial Informatics. doi: 10.1109/TII.2015.2420951

• Pan, S., Morris, T., Adhikari, U., A Specification-based Intrusion Detection Framework for Cyber-physical Environment in Electric Power System, International Journal of Network Security (IJNS), Vol.17, No.2, PP.174-188, March 2015.

• Beaver, J., Borges, R., Buckner, M., Morris, T., Adhikari, U., Pan, S., Machine Learning for Power System Disturbance and Cyber-attack Discrimination, Proceedings of the 7th International Symposium on Resilient Control Systems, August 19-21,2014, Denver, CO, USA.

Additional Articles

1. Industrial Control System Traffic Datasets For Intrusion Detection Research

2. Cyber-Attack Detection for Industrial Control System Monitoring with Support Vector Machine Based on Communication Profile

3. Efficient Cyber Attack Detection in Industrial Control Systems Using Lightweight Neural Networks and PCA

4. Measuring the Risk of Cyber Attack in Industrial Control Systems

5. An Ensemble Deep Learning-Based Cyber-Attack Detection in Industrial Control System