Ontology-based approach for malicious behaviour detection in synchrophasor networks

Synchrophasor systems are becoming a vital requirement for real-time monitoring, control and protection of emerging Smart Grids that need cyber security issues be carefully analysed and mitigated. This paper proposes a behaviour-based ontology on the Syncrophasor communications for the detection of malicious system behaviours. Syncrophasor activities are represented with their causal relationships using a flexible semantic model. The developed model bridges the gap between system behaviours and the exchanged data and commands in the network. A set of semantic rules are created to assist in identifying malicious activities that are deviating from the expected behaviour in the model. The proposed approach is prototyped and tested for its applicability in detecting cyber-attacks. Furthermore, a use case for valuable information extraction is described using query-based engine over the ontology knowledge. The presented results demonstrate the usefulness and flexibility of the proposed approach in detecting malicious activities that could improve Syncrophasor network security.