Intrusion Detection and Prevention for ZigBee-Based Home Area Networks in Smart Grids

In this paper, we present a novel intrusion detection and prevention system for ZigBee-based home area networks in smart grids, HANIDPS. HANIDPS employs a model-based intrusion detection mechanism as well as a machine learning-based intrusion prevention system to protect the network against a wide range of attack types. The detection module extracts network features and analyzes them to decide whether the network is in a normal state. We use smart energy profile 2.0 specification as well as IEEE 802.15.4 standard to precisely characterize the expected normal behavior. A set of defensive actions are defined for the prevention system which are effective in stopping various attack types. HANIDPS uses Q-learning and through interactions with environment learns the best strategy against an attack. Use of model-based approach for intrusion detection and dynamic learning for intrusion prevention, as well as employment of effective mechanisms to stop the attacks, provide a high performance for HANIDPS without the need for prior knowledge of the attacks. Soundness of the proposed method is evaluated through extensive analysis and experiments.