Fraudulent Data Injection Detection in Smart Meters with IEC-60870-5-104 Communication Protocol Using LSTM Autoencoder

Abstract

Advanced Information Communication Technology (ICT) is used in the Smart Grid (SG) system to introduce both intelligence and efficiency to the conventional power system. Today, smart meters are integrated with billing utilities, such as national control centers (NCC), and advanced metering infrastructure (AMI), which are highly dependent on IoT (Internet of Things). This, however, eventually introduces vulnerabilities and network anomalies like fraudulent data injection. In this thesis, we focus primarily on the security vulnerabilities such as the Man-In-The-Middle attack and the Replay attack associated with smart meters that occur when energy consumption data is reported to the billing system, specifically through the IEC-60870-104 protocol. In this thesis, we propose an algorithm for anomaly detection with LSTM Autoencoder, which combines the functional benefits of LSTM and the deep learning of autoencoders. The dataset used to train the algorithm is collected with a simulation testbed using the IEC-60870-104 master and slave protocol simulators in a virtual environment with and without attack vectors labelled as malicious and benign, respectively. The collected traffic packets are pre-processed, and specific features are selected and extracted so the algorithm can be used to build the model effectively. The training and threshold calculation of the anomaly detection algorithm is performed with benign data, and testing is done by combining benign and malicious data. The test results are evaluated with conventional machine learning model evaluation techniques such as confusion matrix, and evaluation metrics, which exhibit the model performance.

Date of Award	2023
Original language	American English
Awarding Institution	HBKU College of Science and Engineering