ML-based Alert Correlation Algorithms For DER Cyber Situational Awareness
Moataz Abdelkhalek, Manimaran Govindarasu · 2024
The wide integration of Distributed Energy Resources (DER) in the smart grid has exposed them to various cyber and physical threats. To support security and provide resilience, intrusion and anomaly detection systems (IADS) have been widely used. However, the dynamic real-time nature of DER networks poses several challenges to the detection process resulting mainly in low-level representation of intrusions, unmanageable number of IADS alerts and high false-positive rates, leading to an impractical and time-consuming response process. Alert correlation can help provide cyber situational awareness for DER networks by identifying the relationships between alerts. This paper proposes a hybrid 2-tier multi-stage alert correlation model that utilizes several similarity-based and spatial-temporal statistical-based machine learning (ML algorithms to provide cyber situational awareness and detection confidence tailored for DER characteristics while being protocol and environment neutral and IADS platform agnostic. The proposed model was trained with DER-specific datasets and features to reduce, verify, and track known/unknown attacks at a fine granularity. This results in higher-level correlated graphical and incident situational representations allowing for severity-based effective mitigations. The model was evaluated into a realistic 2-tier hardware-in-the-loop (HIL) smart grid DER testbed environment with multiple distributed correlation sensors and a centralized cloud-based correlation master engine. The proposed model achieved high correlation completeness (97.67%, high correlation accuracy (99.2%, real-time feasible latency ($\approx$0.12ms, high reduction ratio ($\approx$752:1, and very low false-positive and false-negative correlation rates (0.066% and (0.023% respectively, for real-time deployment.