Detection and classification of concurrent attacks in substation automation systems using wavelet design and deep learning

This paper presents a novel approach to detect and classify cyberattacks using wavelet design and deep learning. Existing works fail to investigate concurrent cyberattacks and works that utilize time-frequency features for cyberattack detection only use the existing standard wavelet filters that have not been designed for cybersecurity applications. This work proposes a detection scheme for concurrent attacks using new wavelet filters with the Discrete Wavelet Transform (DWT) to better extract time-frequency features from substation automation system (SAS) data. A set of new wavelet filters are generated from parameterized equations. The wavelet filter that best suits SAS cyberattack detection is used to extract the salient features of cyberattacks using the DWT. Unlike existing detection approaches, the use of wavelet design allows the generation of new wavelet filters that better match the time-frequency features of SAS data. The proposed approach has been tested on a publicly available dataset as well as experimentally using OPAL-RT. The results demonstrate its effectiveness in detecting four popular cyberattack types as well as the challenging concurrent attacks, which involve two or more attacks occurring simultaneously. The use of the wavelets not only enables the detection of the attacks but also their classification by type from power disturbances with an accuracy reaching 99.12% on a synthetic dataset and 95.47% on an experimental dataset. Furthermore, the results have shown that the use of the newly designed wavelets leads to an increase in the detection accuracy by 9.36% and a significant reduction in the computational complexity of the feature extraction process by up to 99.16% over the existing time-frequency transforms.