Unmasking Covert Intrusions: Detection of Fault-Masking Cyberattacks on Differential Protection Systems

• URL: http://arxiv.org/abs/2409.04242v1
• Date: Fri, 6 Sep 2024 12:47:15 GMT
• Title: Unmasking Covert Intrusions: Detection of Fault-Masking Cyberattacks on Differential Protection Systems
• Abstract summary: Fault-Masking Attacks (FMAs) are stealthy cyberattacks performed by manipulating the remote measurements of the targeted LCDR. We propose a two- module framework to detect FMAs. Our simulation results confirm that the proposed framework can accurately detect FMAs on LCDRs.
• Score: 2.030738254233949
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: Line Current Differential Relays (LCDRs) are high-speed relays progressively used to protect critical transmission lines. However, LCDRs are vulnerable to cyberattacks. Fault-Masking Attacks (FMAs) are stealthy cyberattacks performed by manipulating the remote measurements of the targeted LCDR to disguise faults on the protected line. Hence, they remain undetected by this LCDR. In this paper, we propose a two-module framework to detect FMAs. The first module is a Mismatch Index (MI) developed from the protected transmission line's equivalent physical model. The MI is triggered only if there is a significant mismatch in the LCDR's local and remote measurements while the LCDR itself is untriggered, which indicates an FMA. After the MI is triggered, the second module, a neural network-based classifier, promptly confirms that the triggering event is a physical fault that lies on the line protected by the LCDR before declaring the occurrence of an FMA. The proposed framework is tested using the IEEE 39-bus benchmark system. Our simulation results confirm that the proposed framework can accurately detect FMAs on LCDRs and is not affected by normal system disturbances, variations, or measurement noise. Our experimental results using OPAL-RT's real-time simulator confirm the proposed solution's real-time performance capability.

Related papers

• Attack Detection using Time Series Foundation Models [20.398472851483188]
  This paper addresses the problem of attack detection in cyber-physical systems without any knowledge of the plant model or its structure.<n>We propose a model-structure-free detector based on TimesFM, a time-series foundation model developed by Google Research.<n>We show empirically that the TimesFM-based detector achieves a comparable or superior attack detection performance.
  arXiv  Detail & Related papers  (2026-06-04T16:19:24Z)
• An AI-Based Supervisory Measurement Integrity Validation Layer for Cyber-Resilient AC/DC Protection in Inverter-Based Microgrids [2.641443854998644]
  Line current differential relays (LCDRs) rely on time-synchronized multi-phase current waveforms to infer faults in AC and DC power networks.<n>In inverter-based microgrids, the increasing reliance on digitally communicated measurements exposes LCDRs to false-data injection attacks (FDIAs)<n>This paper introduces a measurement integrity validation scheme that operates as a supervisory instrumentation layer for modern LCDRs.
  arXiv  Detail & Related papers  (2026-04-26T11:46:23Z)
• Cross-Modal Phantom: Coordinated Camera-LiDAR Spoofing Against Multi-Sensor Fusion in Autonomous Vehicles [2.1485350418225244]
  We investigate whether an attacker can bypass Multi-Sensor Fusion's redundancy by fabricating cross-sensor consistency.<n>We simulate its sensor-level outcomes by inserting perspective-aware image patches and synthetic LiDAR point clusters aligned in 3D space.<n>Using 400 KITTI scenes, our large-scale evaluation shows that the coordinated spoofing deceives a state-of-the-art perception model with an 85.5% successful attack rate.
  arXiv  Detail & Related papers  (2026-04-23T16:32:01Z)
• Large Language Models for Detecting Cyberattacks on Smart Grid Protective Relays [1.6809655100067975]
  DistilBERT detects 97.6% of cyberattacks without compromising TCDR dependability.<n>DistilBERT achieves latency below 6 ms on a commercial workstation.<n>GPT-2 and DistilBERT+LoRA achieve comparable performance.
  arXiv  Detail & Related papers  (2026-01-07T23:12:03Z)
• Online Reliable Anomaly Detection via Neuromorphic Sensing and Communications [58.796149594878585]
  This paper proposes a low-power online anomaly detection framework based on neuromorphic wireless sensor networks.<n>In the considered system, a central reader node actively queries a subset of neuromorphic sensor nodes (neuro-SNs) at each time frame.<n>The neuromorphic sensors are event-driven, producing spikes in correspondence to relevant changes in the monitored system.
  arXiv  Detail & Related papers  (2025-10-16T13:56:54Z)
• Adaptive Attacks on Trusted Monitors Subvert AI Control Protocols [80.68060125494645]
  We study adaptive attacks by an untrusted model that knows the protocol and the monitor model.<n>We instantiate a simple adaptive attack vector by which the attacker embeds publicly known or zero-shot prompt injections in the model outputs.
  arXiv  Detail & Related papers  (2025-10-10T15:12:44Z)
• ViSTR-GP: Online Cyberattack Detection via Vision-to-State Tensor Regression and Gaussian Processes in Automated Robotic Operations [5.95097350945477]
  Connected and automated factories face growing cybersecurity risks that can potentially cause interruptions and damages to physical operations.<n>Data-integrity attacks often involve sophisticated exploitation of vulnerabilities that enable an attacker to access and manipulate the operational data.<n>This paper develops an online detection framework, ViSTR-GP, that cross-checks encoder-reported measurements against a vision-based estimate from an overhead camera outside the controller's authority.
  arXiv  Detail & Related papers  (2025-09-13T19:10:35Z)
• SAMITE: Position Prompted SAM2 with Calibrated Memory for Visual Object Tracking [58.35852822355312]
  Visual Object Tracking (VOT) is widely used in applications like autonomous driving to continuously track targets in videos.<n>To address these issues, some methods propose to adapt the video foundation model SAM2 for VOT, where the tracking results of each frame would be encoded as memory for conditioning the rest of frames in an autoregressive manner.<n>We present a SAMITE model, built upon SAM2 with additional modules, to tackle these challenges.
  arXiv  Detail & Related papers  (2025-07-29T12:11:56Z)
• Adversarial Attacks on Deep Learning-Based False Data Injection Detection in Differential Relays [3.4061238650474666]
  This paper demonstrates that adversarial attacks, carefully crafted FDIAs, can evade existing Deep Learning-based Schemes (DLSs) used for False Data Injection Attacks (FDIAs) in smart grids.<n>We propose a novel adversarial attack framework, utilizing the Fast Gradient Sign Method, which exploits DLS vulnerabilities.<n>Our results highlight the significant threat posed by adversarial attacks to DLS-based FDIA detection, underscore the necessity for robust cybersecurity measures in smart grids, and demonstrate the effectiveness of adversarial training in enhancing model robustness against adversarial FDIAs.
  arXiv  Detail & Related papers  (2025-06-24T04:22:26Z)
• CANTXSec: A Deterministic Intrusion Detection and Prevention System for CAN Bus Monitoring ECU Activations [53.036288487863786]
  We propose CANTXSec, the first deterministic Intrusion Detection and Prevention system based on physical ECU activations.<n>It detects and prevents classical attacks in the CAN bus, while detecting advanced attacks that have been less investigated in the literature.<n>We prove the effectiveness of our solution on a physical testbed, where we achieve 100% detection accuracy in both classes of attacks while preventing 100% of FIAs.
  arXiv  Detail & Related papers  (2025-05-14T13:37:07Z)
• Natural Reflection Backdoor Attack on Vision Language Model for Autonomous Driving [55.96227460521096]
  Vision-Language Models (VLMs) have been integrated into autonomous driving systems to enhance reasoning capabilities.<n>We propose a natural reflection-based backdoor attack targeting VLM systems in autonomous driving scenarios.<n>Our findings uncover a new class of attacks that exploit the stringent real-time requirements of autonomous driving.
  arXiv  Detail & Related papers  (2025-05-09T20:28:17Z)
• GNN-Enhanced Fault Diagnosis Method for Parallel Cyber-physical Attacks in Power Grids [5.219266802392682]
  Parallel cyber-physical attacks (PCPA) damage physical transmission lines and block measurement data transmission in power grids.<n>This paper investigates the fault diagnosis problem for a linearized (DC) power flow model under PCPA.<n>We propose a fault diagnosis framework based on meta-mixed-integer programming (MMIP), integrating graph attention network-based fault localization (GAT-FL)
  arXiv  Detail & Related papers  (2025-03-03T05:10:41Z)
• Detecting Masquerade Attacks in Controller Area Networks Using Graph Machine Learning [0.2812395851874055]
  This paper introduces a novel framework for detecting masquerade attacks in the CAN bus using graph machine learning (ML) We show that by representing CAN bus frames as message sequence graphs (MSGs) and enriching each node with contextual statistical attributes from time series, we can enhance detection capabilities. Our method ensures a comprehensive and dynamic analysis of CAN frame interactions, improving robustness and efficiency.
  arXiv  Detail & Related papers  (2024-08-10T04:17:58Z)
• LaserEscape: Detecting and Mitigating Optical Probing Attacks [5.4511018094405905]
  We introduce LaserEscape, the first fully digital and FPGA-compatible countermeasure to detect and mitigate optical probing attacks. LaserEscape incorporates digital delay-based sensors to reliably detect the physical alteration on the fabric caused by laser beam irradiations in real time. As a response to the attack, LaserEscape deploys real-time hiding approaches using randomized hardware reconfigurability.
  arXiv  Detail & Related papers  (2024-05-06T16:49:11Z)
• On the Potential of Re-configurable Intelligent Surface (RIS)-assisted Physical Layer Authentication (PLA) [0.0]
  Re-configurable Intelligent Surfaces (RIS) technology is increasingly becoming a potential component for next-generation wireless networks. However, the broadcast nature of RIS-assisted wireless communication makes it vulnerable to malicious attacks at the physical layer. This paper investigates RIS-assisted wireless communication systems to unlock the potential of using RIS for physical layer authentication (PLA)
  arXiv  Detail & Related papers  (2024-05-01T10:17:24Z)
• Detector-Free Structure from Motion [63.5577809314603]
  We propose a new structure-from-motion framework to recover accurate camera poses and point clouds from unordered images. Our framework first reconstructs a coarse SfM model from quantized detector-free matches. Experiments demonstrate that the proposed framework outperforms existing detector-based SfM systems.
  arXiv  Detail & Related papers  (2023-06-27T17:59:39Z)
• Self-Supervised Masked Convolutional Transformer Block for Anomaly Detection [122.4894940892536]
  We present a novel self-supervised masked convolutional transformer block (SSMCTB) that comprises the reconstruction-based functionality at a core architectural level. In this work, we extend our previous self-supervised predictive convolutional attentive block (SSPCAB) with a 3D masked convolutional layer, a transformer for channel-wise attention, as well as a novel self-supervised objective based on Huber loss.
  arXiv  Detail & Related papers  (2022-09-25T04:56:10Z)
• Just Noticeable Difference Modeling for Face Recognition System [69.28990314553076]
  We make the first attempt to study just noticeable difference (JND) for the automatic face recognition system. We develop a novel JND prediction model to directly infer JND images for the FR system. Experimental results have demonstrated that the proposed model achieves higher accuracy of JND map prediction.
  arXiv  Detail & Related papers  (2022-09-13T10:06:36Z)
• Adaptive Shrink-Mask for Text Detection [91.34459257409104]
  Existing real-time text detectors reconstruct text contours by shrink-masks directly. The dependence on predicted shrink-masks leads to unstable detection results. Super-pixel Window (SPW) is designed to supervise the network.
  arXiv  Detail & Related papers  (2021-11-18T07:38:57Z)
• A Hybrid Video Anomaly Detection Framework via Memory-Augmented Flow Reconstruction and Flow-Guided Frame Prediction [34.565986275769745]
  $textHF2$-VAD is a Hybrid framework that integrates Flow reconstruction and Frame prediction. We design the network of ML-MemAE-SC to memorize normal patterns for optical flow reconstruction. We then employ a Conditional Variational Autoencoder to predict the next frame given several previous frames.
  arXiv  Detail & Related papers  (2021-08-16T01:37:29Z)
• Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks [62.923992740383966]
  We present the first study of security issues of MSF-based perception in AD systems. We generate a physically-realizable, adversarial 3D-printed object that misleads an AD system to fail in detecting it and thus crash into it. Our results show that the attack achieves over 90% success rate across different object types and MSF.
  arXiv  Detail & Related papers  (2021-06-17T05:11:07Z)
• Risk-Averse MPC via Visual-Inertial Input and Recurrent Networks for Online Collision Avoidance [95.86944752753564]
  We propose an online path planning architecture that extends the model predictive control (MPC) formulation to consider future location uncertainties. Our algorithm combines an object detection pipeline with a recurrent neural network (RNN) which infers the covariance of state estimates. The robustness of our methods is validated on complex quadruped robot dynamics and can be generally applied to most robotic platforms.
  arXiv  Detail & Related papers  (2020-07-28T07:34:30Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.