A novel analytic approach for insider and outsider attack detection and classification using the dual-tree complex wavelet transform and convolutional neural networks

• A novel approach to detect and classify both insider and outsider is proposed. • Both physical and cyber data are represented in a time-frequency complex wavelet . domain to enable the extraction of the key features of both insider and outsider attacks . • The proposed approach has been tested experimentally in real-time using an OPAL-RT. • The results have demonstrated its effectiveness in detecting both outsider and insider attacks at an accuracy of 99.00 %. This paper presents a novel approach to detect and classify both insider and outsider attacks targeting smart digital substation automation systems (SD-SASs). An Intrusion Detection System (IDS) based upon the Dual-Tree Complex Wavelet Transform (DT-CWT) and deep learning is used to detect outsider attacks, which are initiated by unauthorized actors, and insider attacks, which are performed by authorized users who have legitimate access to SD-SASs. In this work, both physical and cyber data are represented in a joint time-frequency complex wavelet domain to enable the extraction of the key features of both insider and outsider attacks. The presented approach is analytic as it uses complex wavelets that preserve the information of both physical and cyber features in both the real and imaginary components of the wavelet coefficients instead of only using the real-valued coefficients for feature representation as in real transforms. The resulting IDS is experimentally tested on collected real-time data using OPAL-RT and the results have demonstrated its effectiveness in detecting both outsider and insider attacks at an accuracy of 99.00 %. The use of the DT-CWT improves the detection accuracy compared to other approaches and enables the classification of such attacks from other power disturbances.