Machine Learning: The Smart Grid Cyber Defense?

While smart grids have many advantages, they also present extra cybersecurity challenges. They have more open access points for attackers, especially for facilitating energy theft through smart meters.

Traditional cybersecurity models struggle against complex attacks, such as black-box evasion attacks. However, researchers from the State University of New York (SUNY) have developed an explainable artificial intelligence (XAI) anomaly detector that can identify malicious activities and withstand black box evasion attacks on smart grid infrastructure.

Cybersecurity is essential in a smart grid. Image used courtesy of Adobe Stock

Energy Theft in Smart Grids

Smart meters are key to smart grids’ advanced metering infrastructure (AMI), enabling two-way communication between utility companies and users. However, AMIs are vulnerable to electricity theft and can compromise the smart meters, resulting in false consumption readings for the energy supplier. This can lead to poor decision-making by energy suppliers and those managing grid distributions, as these false consumption readings can affect load and energy management operations. They show the wrong amount of energy flowing around the grid, which affects grid reliability.

Machine Learning Detectors—Protection and Challenges

Machine learning detectors―binary (supervised) and anomaly (unsupervised)―have effectively detected electricity theft. However, binary detectors are designed only to detect specific attacks they have been trained to detect. They are not versatile enough to stop new threats beyond what they’ve been designed to detect.

Anomaly detectors train on benign data and can detect any deviation from benign consumption patterns (anomalies). However, they only achieve high performance when using an ideal threshold to separate benign and malicious data.

All machine learning detectors (binary and anomaly) are susceptible to adversarial evasion attacks where small changes are made to malicious readings, enabling attackers to avoid detection and steal electricity.

Black-box attack. Image used courtesy of Elgarhy et al.

XAI and adversarial attacks are connected with adversarial evasion samples resulting in anomalous XAI model explanations. XAI is a method that helps humans better understand decisions made by machine learning black-box models and could potentially defend against adversarial evasion attacks.

The Hybrid Detector Using XAI

SUNY researchers developed a cluster-based hybrid anomaly detector combining a one-class support vector machine (OCSVM) with a deep auto-encoder. This approach removes the detector’s sensitivity threshold while enhancing its classification performance, allowing it to defend against adversarial evasion attacks using XAI.

The detector trained on consumption readings with XAI explanations generated using the Shapley Additive Explanations (SHAP) method, a common method for interpreting machine learning models. This approach enabled the detector to be highly robust against different evasion attacks, including gradient-based and optimization-based methods, and detect zero-day attacks without selecting the optimal threshold value.

The detector was robust against several evasion attacks, including:

• Fast gradient sign method
• Basic iterative method
• Carlini Wagner
• Zeroth-order optimization
• Deepfool

The SHAP explanations distinguished between normal and abnormal consumption patterns so the detector could identify any anomalies the evasion samples caused. Additionally, the OCSVM automatically selects the threshold for the detector, eliminating the need for selecting an optimal value.

The XAI model. Image used courtesy of Elgarhy et al.

As power grids use smarter technology, secure communication networks between all aspects of the grid will be crucial, and detecting anomalies in the network will be essential to prevent electrical theft. This approach could offer a more robust detector framework for protecting smart grids against adversarial evasion attacks. This will become more important as infrastructure transitions to smart grids without the ideal cybersecurity measures.

Trust Between Parties

The XAI model clearly explained its detection decisions. This XAI-based model provided a much higher degree of transparency than conventional black-box models, which often don’t state why an alert has been triggered. This provides a level of trust between the algorithms and the operators.