Detection and classification of concurrent attacks in substation automation systems using wavelet design and deep learning
Bibliographic record
Abstract
This paper presents a novel approach to detect and classify cyberattacks using wavelet design and deep learning. Existing works fail to investigate concurrent cyberattacks and works that utilize time-frequency features for cyberattack detection only use the existing standard wavelet filters that have not been designed for cybersecurity applications. This work proposes a detection scheme for concurrent attacks using new wavelet filters with the Discrete Wavelet Transform (DWT) to better extract time-frequency features from substation automation system (SAS) data. A set of new wavelet filters are generated from parameterized equations. The wavelet filter that best suits SAS cyberattack detection is used to extract the salient features of cyberattacks using the DWT. Unlike existing detection approaches, the use of wavelet design allows the generation of new wavelet filters that better match the time-frequency features of SAS data. The proposed approach has been tested on a publicly available dataset as well as experimentally using OPAL-RT. The results demonstrate its effectiveness in detecting four popular cyberattack types as well as the challenging concurrent attacks, which involve two or more attacks occurring simultaneously. The use of the wavelets not only enables the detection of the attacks but also their classification by type from power disturbances with an accuracy reaching 99.12% on a synthetic dataset and 95.47% on an experimental dataset. Furthermore, the results have shown that the use of the newly designed wavelets leads to an increase in the detection accuracy by 9.36% and a significant reduction in the computational complexity of the feature extraction process by up to 99.16% over the existing time-frequency transforms.
Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.
How this classification was reachedexpand
Full frame distilled prediction
Teacher imitationNot calibrated prevalence, not ground truth. Human validation pending. Learned from the 10,348 direct Codex labels and 10,348 direct Gemma labels. Candidate is the union of thresholded teacher heads; consensus is their intersection. These outputs are machine_predicted_unvalidated and are not human labels or direct frontier model labels.
Codex and Gemma teacher scores by category
| Category | Codex | Gemma |
|---|---|---|
| Metaresearch | 0.000 | 0.000 |
| Meta-epidemiology (narrow) | 0.000 | 0.000 |
| Meta-epidemiology (broad) | 0.000 | 0.000 |
| Bibliometrics | 0.000 | 0.000 |
| Science and technology studies | 0.000 | 0.000 |
| Scholarly communication | 0.000 | 0.000 |
| Open science | 0.000 | 0.000 |
| Research integrity | 0.000 | 0.000 |
| Insufficient payload (model declined to judge) | 0.000 | 0.000 |
Machine scores (provisional)
The two teacher heads of the student model, read on this work. A score orders the frame for review; it never asserts a category, and the validation status ships verbatim with every row.
Baseline scores from an immature model (maturity gate not passed, 7 training rounds). Scores rank; they never assert a category.
score_only:v0-immature-baseline · verbatim from the scoring run: score_only means the number may rank works, and no category label ships from itClassification
machine, unvalidatedMachine predicted; a candidate call from one teacher head, not a consensus.
How this classification was reached, model by model and score by score, is at the end of the page under "How this classification was reached".