arXiv:2508.08593cs.CRcs.AI2025-08被引 1

用生成式AI构建电网安全数据与检测系统,解决攻击样本稀缺难题。

Generative AI for Critical Infrastructure in Smart Grids: A Unified Framework for Synthetic Data Generation and Anomaly Detection

  • 用对抗性流量变异生成符合IEC61850协议的仿真攻击数据。
  • 生成数据训练的AI检测系统在零日攻击识别上显著优于传统机器学习方法。
  • 适合智能电网安全研究人员和电力系统工程师参考使用。

在数字化变电站中,网络安全事件对电力系统持续运行构成重大挑战。为应对这些挑战,需建立稳健的防御策略。信息与通信技术(ICT)框架中的异常识别与检测过程对保障设备间安全可靠的通信与协调至关重要。本文聚焦现代智能电网中基于IEC61850的数字化变电站所面临的严峻网络安全问题,该类系统虽集成通用面向对象变电站事件(GOOSE)等先进通信协议以提升能源管理效率,但也引入了显著的网络攻击漏洞。针对传统异常检测系统(ADS)在威胁发现上的局限,本研究提出一种创新性解决方案:利用生成式AI(GenAI)构建鲁棒的新型检测系统。主要贡献包括:提出先进的对抗性流量变异(AATM)技术,生成符合协议规范、数据均衡的合成GOOSE消息数据集,支持真实零日攻击模式的构建,缓解数据稀缺问题;探索结合任务导向对话(ToD)流程的生成式AI检测系统,提升攻击模式识别能力;最后通过对比分析,验证基于AATM生成数据的生成式AI检测系统在标准与先进性能指标下,全面优于传统机器学习方法。

原文摘要 · Abstract (English)

In digital substations, security events pose significant challenges to the sustained operation of power systems. To mitigate these challenges, the implementation of robust defense strategies is critically important. A thorough process of anomaly identification and detection in information and communication technology (ICT) frameworks is crucial to ensure secure and reliable communication and coordination between interconnected devices within digital substations. Hence, this paper addresses the critical cybersecurity challenges confronting IEC61850-based digital substations within modern smart grids, where the integration of advanced communication protocols, e.g., generic object-oriented substation event (GOOSE), has enhanced energy management and introduced significant vulnerabilities to cyberattacks. Focusing on the limitations of traditional anomaly detection systems (ADSs) in detecting threats, this research proposes a transformative approach by leveraging generative AI (GenAI) to develop robust ADSs. The primary contributions include the suggested advanced adversarial traffic mutation (AATM) technique to generate synthesized and balanced datasets for GOOSE messages, ensuring protocol compliance and enabling realistic zero-day attack pattern creation to address data scarcity. Then, the implementation of GenAI-based ADSs incorporating the task-oriented dialogue (ToD) processes has been explored for improved detection of attack patterns. Finally, a comparison of the GenAI-based ADS with machine learning (ML)-based ADSs has been implemented to showcase the outperformance of the GenAI-based frameworks considering the AATM-generated GOOSE datasets and standard/advanced performance evaluation metrics.

生成式AI电网安全异常检测数据生成

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。