Cyber Analytics for Energy Infrastructure Networks

By Preetha Thulasiraman, PhD, Associate Professor Electrical and Computer Engineering, NPS

In 2019, the Naval Facilities Engineering Systems Command (NAVFAC), deployed the Navy Smart Grid enterprise energy management solution. With Smart Grid, an operator in a central command location can monitor energy data in near-real time, deploying technicians to efficiently manage emergencies, outages and repairs. The Department of Navy (DoN) plans to deploy Smart Grid across the shore enterprise over the next several years to enhance resiliency on its installations. However, in order for the Navy to ensure resiliency of the smart grid network, effective countermeasures against security threats must be addressed using techniques that adapt to the massive data that is collected by smart sensors and meters.

The goal of our research is to develop cost-effective, cyber threat detection techniques to secure energy infrastructure that is critical to the Navy. Our research is focused on the use of cyber analytics to continually define and mitigate evolving threat vectors for the Navy smart grid as well as other energy infrastructure networks.

Traditionally, cyber security is managed with reactive solutions that respond to incidents once they have occurred. Cyber analytics is a proactive approach to cyber defense, in which future attack strategies are anticipated and insights are incorporated into the response management of active attacks in real time. Supervised and unsupervised machine learning approaches, including artificial neural networks and statistical data analysis are key to developing cyber analytic tools that will allow the accurate classification/identification of adversarial and malicious network activity.

Over the last year, this project has investigated the use of supervised learning techniques to build predictive cyber defense systems for the Navy smart grid. We began with supervised learning due to its simplicity and to show cyber analytics can be feasible in the context of the Navy smart grid. Specifically, we built a simple Intrusion Detection System (IDS) that is located at the data concentrators of the smart grid. These concentrators receive the data from the wireless networks before pushing it to the local control center. The IDS is a combination of classifier, to quickly detect known attacks, and an anomaly detector to detect new threats. We used a weighted K-Nearest Neighbor (KNN) approach along with Bayesian classification to implement this IDS. Attacks that were studied included Denial of Service (DoS), port probing, and web attacks. The probability of detection and the false positive rate were statistics of significance. We found that our threat detection rate ranged from 93% to 98%, depending on the type of attack and the combination of attacks for each experiment. We proved that different attacks can be grouped together based on objectives, and that machine learning using a weighted KNN algorithm can be used to segregate the various classes of attack traffic from benign traffic.

The past year of research has been foundational. Our current research efforts are focused on unsupervised learning with an emphasis on neural network autoencoders and predictive optimization. We are training our algorithms on NAVFAC provided data sets that include current, voltage levels, and energy consumption from various smart meters within the smart grid architecture. Preliminary results show a 96% detection rate of irregular data values. As we continue to build our IDS and integrate sophisticated yet optimal multi-layer learning techniques, our ability to predict complicated threats on DoN energy asset networks will improve.