Detection and classification of concurrent attacks in substation automation systems using wavelet design and deep learning
Bibliographic record
Abstract
This paper presents a novel approach to detect and classify cyberattacks using wavelet design and deep learning. Existing works fail to investigate concurrent cyberattacks and works that utilize time-frequency features for cyberattack detection only use the existing standard wavelet filters that have not been designed for cybersecurity applications. This work proposes a detection scheme for concurrent attacks using new wavelet filters with the Discrete Wavelet Transform (DWT) to better extract time-frequency features from substation automation system (SAS) data. A set of new wavelet filters are generated from parameterized equations. The wavelet filter that best suits SAS cyberattack detection is used to extract the salient features of cyberattacks using the DWT. Unlike existing detection approaches, the use of wavelet design allows the generation of new wavelet filters that better match the time-frequency features of SAS data. The proposed approach has been tested on a publicly available dataset as well as experimentally using OPAL-RT. The results demonstrate its effectiveness in detecting four popular cyberattack types as well as the challenging concurrent attacks, which involve two or more attacks occurring simultaneously. The use of the wavelets not only enables the detection of the attacks but also their classification by type from power disturbances with an accuracy reaching 99.12% on a synthetic dataset and 95.47% on an experimental dataset. Furthermore, the results have shown that the use of the newly designed wavelets leads to an increase in the detection accuracy by 9.36% and a significant reduction in the computational complexity of the feature extraction process by up to 99.16% over the existing time-frequency transforms.
Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.
How this classification was reachedexpand
Full frame machine prediction
Teacher imitationNot calibrated prevalence, not ground truth. Human validation pending. The Gemma side is a direct model label for every work in the frame, read from the title-only record. The Codex side is a classifier learned from the 10,348 direct Codex labels and calibrated to design-weighted sample rates; fields without enough sample support carry no Codex call. Candidate is the union of the two sides; consensus is their intersection. These outputs are machine_predicted_unvalidated and are not human labels.
Distilled classifier scores by category (both heads)
| Category | Codex | Gemma |
|---|---|---|
| Metaresearch | 0.001 | 0.002 |
| Meta-epidemiology (narrow) | 0.001 | 0.000 |
| Meta-epidemiology (broad) | 0.001 | 0.001 |
| Bibliometrics | 0.001 | 0.001 |
| Science and technology studies | 0.000 | 0.000 |
| Scholarly communication | 0.001 | 0.001 |
| Open science | 0.001 | 0.001 |
| Research integrity | 0.001 | 0.002 |
| Insufficient payload (model declined to judge) | 0.001 | 0.000 |
Machine scores (provisional)
The two teacher heads of the student model, read on this work. A score orders the frame for review; it never asserts a category, and the validation status ships verbatim with every row.
Baseline scores from an immature model (maturity gate not passed, 7 training rounds). Scores rank; they never assert a category.
score_only:v0-immature-baseline · verbatim from the scoring run: score_only means the number may rank works, and no category label ships from itClassification
machine, unvalidatedMachine predicted; a candidate call from one source (direct Gemma or distilled Codex), not a consensus.
How this classification was reached, model by model and score by score, is at the end of the page under "How this classification was reached".