摘要:
The growing use of information and communication technologies information and communication technologies (ICTs) in power grid operational environments has been essential for operators to improve the monitoring, maintenance and control of power generation, transmission and distribution, however, at the expense of an increased grid exposure to cyber threats. Information technology (IT) and operational technology (OT) convergence has incentivized hackers to trigger more attacks on cyber-physical systems in recent years. This has resulted in more global investment on cybersecurity. Moreover, the amount of data flow in such systems is beyond human supervision capabilities. Hence, data driven methods provide a wealth of opportunities to enhance cybersecurity. Of specific interest, we focus on the use of machine learning in an IT/OT converged environment for the purpose of intrusion detection, an essential step in cyber-physical grid security due to the complex nature of emerging power systems. We focus on the IEC 61850 substation environment, which lies at the heart of IT/OT convergence. This thesis first searches for the optimized models using applicable neural network architectures and compares their performances. The results of hyperparameter tuning are used to propose universal models for all types of faults for each architecture for IEC 61850 transformer protection relays. Next, an adversarial training method is proposed to enhance the security of the models. The performance of the models before and after adversarial training is compared. The results are used to propose the best model for enhancing the security of the transformer protective relays. Then, a black-box attack framework is proposed to study the capability of the attacker to conduct a successful attack without knowing the model parameters.