Towards Physics-Based Industrial Malware Detection with Performance and Integrity Analysis Enhanced Via Machine and Deep Learning

Abstract

The security of power system protection infrastructure poses emerging challenges, particularly due to the implications of threats that exploit the physical behavior of power transformers. While prior research has made significant progress in detecting malware within industrial control systems (ICS), there remains a pressing need for more robust and adaptive methodologies capable of addressing evolving cyber threats and advanced intrusive techniques.This study emphasizes the critical role of protection relay algorithms specifically differential and harmonic restraint algorithms in safeguarding power transformers from electrical faults. These algorithms, however, are susceptible to malicious interference; they can be disabled, altered, or suppressed by malware, thereby compromising the reliability and safety of the system. We begin by presenting an overview of a typical electrical power substation architecture and the core functionalities of protection relay algorithms. Furthermore, we explore preliminary insights into malware strategies that involve physics-based data manipulation, potentially leading to transformer maloperation, large-scale blackouts, and permanent equipment damage. To address these vulnerabilities, we propose the design of a hybrid machine learning and deep learning framework aimed at detecting protection anomalies through analysis of computational resource metrics, including memory usage and execution time, associated with relay algorithm execution. The model was developed using Python and evaluated through simulation of differential and harmonic protection logic. Synthetic datasets were generated using a generative adversarial network (GAN) implemented on a virtualized environment to facilitate comprehensive model training and testing