AnSMart: A SVM-based anomaly detection scheme via system profiling in Smart Grids

Anomaly detection techniques analyze consumer spend patterns and grid load profiles to predict possible deviations from normal behavior. However, as the measured data is time-varying, profiling the measured drifts becomes complex owing to the amount of raw generated data. Motivated from the aforementioned discussions, in this paper, we propose a scheme, AnSMart, to predict deviations in smart grid (SG) data through obtained profiling operations. The scheme operates in two phases. In the first phase, valuable grid features are extracted from internal system call lists made by grid kernels after load profiling operations are completed over a day. Then, in the second phase, based on data logs, vector differences are computed for call vectors and malign scenarios are identified. The data is fed to the support vector machine (SVM) model for training, and compromised grid behavior is classified. SVM predicts metrics deviation from normal grids. The deviation is measured depending on parameters like-call vector signal, call-sizes, call-list deviations, and call-return values collected from the open-source libiec61850 library that consists of resource-rich (RR) and resource-limited (RL) libraries for both compromised and uncompromised grids. Based on different cases, a total of 50 experiments were conducted. The obtained F-score is 0.926 and the accuracy of 92.5% is obtained based on system-call stacks and grid operating system (OS) behavior that outperforms the conventional anomaly-based approaches on SG.