An Approach to Abstract Multi-stage Cyberattack Data Generation for ML-Based IDS in Smart Grids

Abstract

Power grids are becoming more digitized, resulting in new opportunities for the grid operation but also new chal-lenges, such as new threats from the cyber-domain. To address these challenges, cybersecurity solutions are being considered in the form of preventive, detective, and reactive measures. Machine learning-based intrusion detection systems are used as part of detection efforts to detect and defend against cyberattacks. However, training and testing data for these systems are often not available or suitable for use in machine learning models for detecting multi-stage cyberattacks in smart grids. In this paper, we propose a method to generate synthetic data using a graph-based approach for training machine learning models in smart grids. We use an abstract form of multi-stage cyberattacks defined via graph formulations and simulate the propagation behavior of attacks in the network. Within the selected scenarios, we observed promising results, but a larger number of scenarios need to be studied to draw a more informed conclusion about the suitability of synthesized data.

Authors 6

1. Ömer Sen Aachen

   RWTH Aachen University

   Affiliation as printed

   IAEW, RWTH Aachen Univserity,Aachen,Germany

   IAEW, RWTH Aachen Univserity, Aachen, Germany

2. Philipp Malskorn Aachen

   RWTH Aachen University

   Affiliation as printed

   IAEW, RWTH Aachen Univserity,Aachen,Germany

   IAEW, RWTH Aachen Univserity, Aachen, Germany

3. Simon Glomb Aachen

   RWTH Aachen University

   Affiliation as printed

   IAEW, RWTH Aachen Univserity,Aachen,Germany

   IAEW, RWTH Aachen Univserity, Aachen, Germany

4. Immanuel Hacker Aachen

   RWTH Aachen University

   Affiliation as printed

   IAEW, RWTH Aachen Univserity,Aachen,Germany

   IAEW, RWTH Aachen Univserity, Aachen, Germany

5. Martin Henze Aachen Security and Privacy in Industrial Cooperation

   Fraunhofer Institute for Communication, Information Processing and Ergonomics · RWTH Aachen University

   Affiliation as printed

   Security and Privacy in Industrial Cooperation, RWTH Aachen University,Aachen,Germany

   Cyber Analysis & Defense, Fraunhofer FKIE, Wachtberg, Germany

   Security and Privacy in Industrial Cooperation, RWTH Aachen University, Aachen, Germany

6. Andreas Ulbig Aachen

   RWTH Aachen University

   Affiliation as printed

   IAEW, RWTH Aachen Univserity,Aachen,Germany

   IAEW, RWTH Aachen Univserity, Aachen, Germany