Anomaly Detection in Electricity Cyber Infrastructures

This paper presents a novel anomaly detection methodology for the protection of electricity critical infrastructures that learns the normal behaviour of the system, builds up a profile and detects anomalous operations which deviate from the profile. This can be used to identify attacks, failures and accidents and it can also be used to improve state estimation, correct topology errors and inform the operators about potential discrepancies between their view of the network and its actual state. This paper will cover two of the anomaly-detecting techniques that we have been developing for electricity networks invariant induction and simulated ants – and a Bayesian methodology for integrating the output of these detectors. The results presented in this paper demonstrate that this technique could make a significant contribution to the security of electricity critical infrastructures.