A Federated Intrusion Response Network for Grids

This work-in-progress paper evaluates Federated Intrusion Response Network for Grids (FIRNet-G), an implementation of the Autonomous Intelligent Cyberdefense Agent (AICA) architecture, using graph machine learning for anomaly detection in power distribution grids. The study focuses on identifying cyber attacks in DNP3 traffic within a simulated multi-substation power utility environment. It integrates DNP3 traffic parsing into FIRNet-G’s knowledge graph and augments the Iowa State University PowerCyberSec SCADA testbed for DNP3 traffic monitoring. A federated neural network model classifies DNP3 attacks, with each FIRNet-G agent observing its local environment and generating node embeddings using GraphSAGE. The paper describes the AICA architecture, its implementation, and introduces a novel node embedding approach using a custom Separating Hashing Vectorizer of Variable Length (SHVVL) algorithm. Future work includes incorporating the Flower.ai federated learning framework, implementing differential privacy, and comparing FIRNet-G’s performance to traditional intrusion detection systems. The research also explores link prediction, anomaly detection based on embedding distances, and integrating vulnerability information to enhance attack detection and prediction. This study advances the development of autonomous cyberdefense systems for critical infrastructure, addressing the challenges of securing power distribution grids against evolving cyber threats.