A Genetic Perspective on Traceability of Collaborative Attacks on False Data Injection

With the high degree of integration of electric power information physical system (CPS), collaborative attacks present the characteristics of strong cross-domain, high covertness and fast evolution, which bring great challenges to the traditional attack detection and traceability. In this paper, we propose a collaborative attack traceability method based on the perspective of ‘attack gene’, by constructing an attack gene ontology model, disassembling the complex attack behaviours into the smallest functional units, and realizing the unified expression of the attack characteristics in the information and physical domains. Based on the Poisson distribution of the impulse gene coding mechanism and the dual-domain spatiotemporal correlation analysis framework, the collaborative attack gene map is effectively constructed, and the spatiotemporal correlation between the attack behaviours is explored. Combining gene matching and Bayesian inference, this paper further proposes an attack traceability algorithm to support the identification and prediction of variant attack paths. The experimental results show that the method has significant advantages in improving the identification accuracy and traceability efficiency of coordinated attacks, which provides a strong support for the active defence of electric power CPS system.