Leveraging Compact Data Accumulator to Enable In-Network Anomaly Detection in Programmable Switches for Power Grids

The escalating cyber-attacks targeting power infrastructure underscore the critical importance of smart grid security. However, existing solutions often struggle with the challenge of balancing security and performance overhead, leading to suboptimal protection or increased operational latency. To address this, we propose an intrusion detection system (IDS) designed to operate within P4-based programmable network devices, enabling real-time identification of critical attacks like distributed denial-of-service (DDoS) and false data injection (FDI). Central to our approach is a novel data structure optimized for time series data, capturing key information such as packet timing and data payload distribution. Leveraging decision trees, a robust machine learning technique, enables effective anomaly detection and prediction. Additionally, we integrate data compression techniques to reduce device memory usage while maintaining detection accuracy. Our evaluation results demonstrate minimal overhead in packet processing speed with 1 to 20 nanoseconds differences per packet, and enhanced data storage efficiency with compression ratios reaching up to 60.9%. Despite these optimizations, there is only a slight decrease in detection accuracy, such as a 2.81% drop in detecting false data injection attack (FDIA).