Smart grids (SGs), a cornerstone of modern power systems, facilitate efficient management and distribution of electricity. Despite their advantages, increased connectivity and reliance on communication networks expand their susceptibility to cyber threats. Machine learning (ML) can radically transform cyber security in SGs and secure protocols as in IEC 60870 standard, an international standard for electric power system communication. Notwithstanding, cyber adversaries are now exploiting ML-based intrusion detection systems (IDS) using adversarial ML attacks, potentially undermining SG security. This article addresses cyber attacks on the communication network of SGs, specifically targeting the IEC 60870-5-104 protocol. We introduce a novel ML-based IDS framework for the IEC 60870-5-104 protocol. Specifically, we employ an artificial neural network (ANN) to analyze a new and realistically representative dataset of IEC 60870-5-104 traffic data, unlike previous research that relies on simulated or unrelated data. This approach assists in identifying anomalies indicative of cyber attacks more accurately. Furthermore, we evaluate the resilience of our ANN model against adversarial attacks, including the fast gradient sign method, projected gradient descent, and Carlini and Wagner attacks. Our results demonstrate that the proposed framework can accurately detect cyber attacks and remains robust to adversarial attacks. This offers efficient and resilient IDS capabilities to detect and mitigate cyber attacks in real-world ML-based adversarial environments.

中文翻译：

---

双刃防御：阻止 IEC 60870-5-104 智能电网中的网络攻击和对抗性机器学习


智能电网（SG）是现代电力系统的基石，促进电力的高效管理和分配。尽管具有优势，但连接性的增强和对通信网络的依赖增加了它们对网络威胁的敏感性。机器学习 (ML) 可以从根本上改变 SG 中的网络安全和安全协议，如 IEC 60870 标准（电力系统通信国际标准）中的安全协议。尽管如此，网络对手现在正在通过对抗性 ML 攻击来利用基于 ML 的入侵检测系统 (IDS)，这可能会破坏 SG 的安全。本文讨论了针对 SG 通信网络的网络攻击，特别针对 IEC 60870-5-104 协议。我们为 IEC 60870-5-104 协议引入了一种新颖的基于 ML 的 IDS 框架。具体来说，我们采用人工神经网络 (ANN) 来分析 IEC 60870-5-104 交通数据的新的且具有现实代表性的数据集，这与之前依赖模拟或不相关数据的研究不同。这种方法有助于更准确地识别表明网络攻击的异常情况。此外，我们评估了 ANN 模型对抗对抗性攻击的弹性，包括快速梯度符号法、投影梯度下降以及 Carlini 和 Wagner 攻击。我们的结果表明，所提出的框架可以准确地检测网络攻击，并且对对抗性攻击保持鲁棒性。这提供了高效且有弹性的 IDS 功能，可以检测和减轻现实世界中基于 ML 的对抗环境中的网络攻击。