A novel approach for cyber defence of electrical distribution networks : The effectiveness of log mining and machine learning methods in detecting intrusions in SCADA systems

The Electric Distribution Grid is facing a number of challenges, often summarised by the 3Ds: Decarbonisation, Decentralisation and Digitalization. Information and Communication Tech- nologies (ICTs) and Smart Grid solutions such as Digital Substations, Remote Terminal Units (RTUs), SCADA systems and Advanced Metering Infrastructure (AMI) have surged as pow- erful allies in the shift towards reliable and enhanced modern infrastructure. However, due to extended connectivity, Smart Grids become more vulnerable to cyber threats that might com- promise power reliability and stability. In parallel, the number and complexity of cyber threats grows by the day and traditional protection protocols start to lack the flexibility to keep our infrastructure safe from attackers. This Master’s Thesis addresses the critical need for enhanced security measures in Electric Dis- tribution Grids by proposing the development of a Deep Learning-based Intrusion Detection System (IDS). Using Data Mining techniques to retrieve both semantic and operational data from SCADA systems software logs deployed in Bayernwerk’s Substations, Control Centers and Data Aggregators, an Autoencoder architecture is proposed to distinguish between normal and anomalous behaviour, leveraging cutting-edge technologies to detect and respond to potential intrusions within the Electric Distribution Grid. Initially, a case study is performed using public dataset NSL-KDD for benchmarking and hyper parameter tuning of the Autoencoder. Later on, the remaining architecture is developed to ac- comodate Bayernwerk’s data. The results of this research demonstrate the IDS’s effectiveness in enhancing the security readiness of Electric Distribution Grids. Through comprehensive test- ing and simulations, including sensitivity analysis of various parameters, the IDS showcases its capability to detect and mitigate cyber threats, with both accuracy and precision above 99,5%, thereby proving itself valuable in safeguarding the integrity and availability of Bayernwerk’s critical energy infrastructure. This work contributes to the growing body of knowledge in securing Smart Grids and reinforces the importance of proactive cybersecurity measures in critical infrastructure protection. The proposed IDS represents a significant step towards ensuring the reliability and resilience of Electric Distribution Grids in the face of evolving cybersecurity threat