A Novel Self-learning Cybersecurity System for Smart Grids

The dynamic nature of cyberattacks, as well as the incorrect predictions of Artificial Intelligence (AI)-based cybersecurity intrusion detection systems, are major impediments to the efficient protection of critical infrastructures’ Information Technology (IT) and Operational Technology (OT) systems, including Electrical Power Energy Systems (EPES). This phenomenon is caused by the cyberattack detection models, which lose their effectiveness over time. The variability of cybersecurity threats makes it difficult to establish and implement a specific model, which detects all types of attacks accurately. The key to system protection is the integration of a cybersecurity framework, which simultaneously addresses new potential threats, fixes misclassified predictions and utilizes the best performing model, according to the most recent data. This work proposes a self-learning engine which is based on the SPARK data analytics framework and is integrated into a cybersecurity platform. The self-learning module provides the opportunity for annotating data to correct misclassifications or to add intelligence regarding previously unknown attacks. Initially, the domain experts submit annotated data through a Visual Analytics (VA) & monitoring system, to start the retraining process. Three (3) machine-learning (ML) methods–Random Forest (RF), Logistic Regression (LR) and K-nearest neighbors (KNN)-as well as one (1) Deep Learning (DL) method-SDAE-are dynamically compared in terms of \(F_1\) score and accuracy. After the completion of the retraining process, the best performing model replaces the existing one and labels the incoming data. The dynamic nature of the self-learning module implies that it gets annotations from users anytime, compares the methods during the retraining process and assigns data labelling to the most accurate model.