ML-based Anomaly Detection System for DER DNP3 Communication in Smart Grid
Moataz Abdelkhalek, Manimaran Govindarasu
Abstract
The increasing integration of Distributed Energy Resources (DER) networks in the smart grid highly affects its reliable and secure operation. DER communication protocols such as Distributed Network Protocol 3 (DNP3) lack basic security mechanisms such as encryption, authentication and authorization, making them vulnerable by design to confidentiality, integrity and availability attacks. This paper proposes a supervised machine learning-based anomaly detection model (ML-ADS) for detecting various stealthy cyber/physical attacks tailored for DER communication. The proposed system can identify anomalies at a fine granularity satisfying real-time latency requirements so that effective mitigations can be applied. To train the model, new DER DNP3-specific datasets were created and feature engineering was used to extract 92 DER physics and pattern-based traffic thresholds. For evaluation, the model was deployed and optimized into a physical low cost Edge Intelligent Device (EID) in a realistic hardware-in-the-loop (HIL) IEEE 39-bus smart grid DER environment. The proposed model achieved high detection accuracy (99.83%) with feasible latency (≈2 µs) for real-time deployment, with very low false-positive and false-negative rates of (0.008%) and (0.51%) respectively.