Intrusion Detection System in the Advanced Metering Infrastructure: A Cross-Layer Feature-Fusion CNN-LSTM-Based Approach
<p>Cross-layer feature-fusion CNN-LSTM intrusion detection model.</p> "> Figure 2
<p>Convolutional neural networks architecture.</p> "> Figure 3
<p>Long short-term memory architecture.</p> "> Figure 4
<p>Feature fusion component architecture.</p> "> Figure 5
<p>Relationship between training loss and epochs.</p> "> Figure 6
<p>Confusion matrix on KDD Cup 99 and NSL-KDD.</p> "> Figure 7
<p>The evaluation parameters of cross-layer feature fusion CNN-LSTM.</p> "> Figure 8
<p>Confusion matrixes on the KDD Cup 99 and NSL-KDD datasets in the five-fold cross-validation experiment.</p> "> Figure 9
<p>The evaluation parameters of the cross-layer feature-fusion CNN-LSTM model in the five-fold cross-validation experiment.</p> "> Figure 10
<p><span class="html-italic">DR</span> of KDD Cup 99.</p> "> Figure 11
<p><span class="html-italic">F</span>-measure of KDD Cup 99.</p> "> Figure 12
<p><span class="html-italic">DR</span> of NSL-KDD.</p> "> Figure 13
<p><span class="html-italic">F</span>-measure of NSL-KDD.</p> ">
Abstract
:1. Introduction
- A cross-layer feature-fusion CNN-LSTM intrusion detection model is proposed. Compared with other models, the proposed model combines the characteristics of the CNN and LSTM and can more effectively identify intrusion information in AMI;
- The fusion feature is adopted to represent the multi-domain characteristics of the data. This avoids the limitations of single features and achieves the complementation of advantages among different features;
- The proposed model was evaluated on the KDD Cup 99 and NSL-KDD datasets, both of which are rich in samples and contain all possible types of attacks of AMI. The Experimental results demonstrate that the proposed cross-layer feature-fusion CNN-LSTM intrusion detection model exhibits better performance than traditional intrusion detection models.
2. Related Work
2.1. AMI Intrusion Detection Based on Traditional Machine Learning
2.2. AMI Intrusion Detection Based on Traditional Deep Learning
3. System Components
3.1. Convolutional Neural Networks Component
3.2. Long Short-Term Memory Networks Component
- (1)
- The sigmoid function is used to determine which contents need to be updated;
- (2)
- The tanh function is used to generate alternative contents for updating.
- (1)
- The sigmoid function is used to determine what content will be output;
- (2)
- The tanh function is used to propose the cell state and obtain the final output of the output gate.
3.3. Feature Fusion Component
3.4. Model Training
- (1)
- Data preprocessing and two-dimensional mapping. First, the input is numerically processed and normalized to facilitate CNN and LSTM processing. The preprocessing results meet the requirements of LSTM. However, the input form of the CNN in this work is a two-dimensional structure, so the standardized data are processed by two-dimensional mapping. Finally, the data are input into the CNN and LSTM components. The specific process is described in detail in Section 4.
- (2)
- Feature extraction and fusion. The features are, respectively, extracted by the CNN and LSTM components, and the fusion of global and periodic features is completed by the feature fusion component. High-dimensional mapping is then completed in the hidden layer of the MLP, and the softmax classifier is used to identify different intrusion behaviors. The softmax classification model is the extension of the logistic regression model in a multi-classification problem, and maps the output of multiple neurons to the interval (0,1). The equation is given by Equation (10), where z represents the input of the softmax layer and C represents the input dimension.
- (3)
- Backpropagation and parameter updating. After classification by softmax, the cross-entropy loss function is first used to calculate the loss between the predicted and actual values. The cross-entropy loss function is given as follows:
4. Dataset Selection and Preprocessing
4.1. Dataset Selection
4.2. Dataset Preprocessing
4.2.1. Numerical and One-Hot Processing
4.2.2. Normalization
4.2.3. Dimension Reduction
5. Experiments and Results
5.1. Experimental Environment and Hyper-Parameter Setting
5.2. Evaluation Metrics
5.3. Experimental Design and Results
6. Conclusions
Author Contributions
Funding
Data Availability Statement
Conflicts of Interest
References
- Sun, C.C.; Sebastian, D.J.; Hahn, A. Intrusion Detection for Cybersecurity of Smart Meters. IEEE Trans. Smart Grid 2020, 99, 1–11. [Google Scholar] [CrossRef]
- Radoglou-Grammatikis, P.I.; Sarigiannidis, P.G. Securing the Smart Grid: A Comprehensive Compilation of Intrusion Detection and Prevention Systems. IEEE Access 2019, 7, 46595–46620. [Google Scholar] [CrossRef]
- Zanetti, M.; Jamhour, E.; Pellenz, M.; Penna, M.; Zambenedetti, V.; Chueiri, I. A Tunable Fraud Detection System for Advanced Metering Infrastructure Using Short-Lived Patterns. IEEE Trans. Smart Grid 2019, 10, 830–840. [Google Scholar] [CrossRef]
- Park, C.H.; Kim, T. Energy Theft Detection in Advanced Metering Infrastructure Based on Anomaly Pattern Detection. Energies 2020, 13, 3832. [Google Scholar] [CrossRef]
- Pedramnia, K.; Rahmani, M. Survey of DoS Attacks on LTE infrastructure used in AMI System and Countermeasures. In Proceedings of the Smart Grid Conference, Sanandaj, Iran, 28–29 November 2018. [Google Scholar]
- Liu, H.; Lang, B. Machine Learning and Deep Learning Methods for Intrusion Detection Systems: A Survey. Appl. Sci. 2019, 9, 4396. [Google Scholar] [CrossRef] [Green Version]
- Ieracitano, C.; Adeel, A.; Morabito, F.C.; Hussain, A. A novel statistical analysis and autoencoder driven intelligent intrusion detection approach. Neurocomputing 2020, 387, 51–62. [Google Scholar] [CrossRef]
- Kuang, F.; Xu, W.; Zhang, S. A novel hybrid KPCA and SVM with GA model for intrusion detection. Appl. Soft Comput. 2014, 18, 178–184. [Google Scholar] [CrossRef]
- Aslahi-Shahri, B.M.; Rahmani, R.; Chizari, M. A hybrid method consisting of GA and SVM for intrusion detection system. Neural Comput. Appl. 2016, 27, 1–8. [Google Scholar] [CrossRef]
- Tahir, H.M.; Hasan, W.; Said, A.M. Hybrid Machine Learning Technique for Intrusion Detection System. In Proceedings of the International Conference on Computing and Informatics, Istanbul, Turkey, 11–13 August 2015. [Google Scholar]
- Shin, D.H.; An, K.K.; Choi, S.C. Malicious Traffic Detection Using K-means. J. Korean Inst. Commun. Inf. Sci. 2016, 41, 277–284. [Google Scholar] [CrossRef] [Green Version]
- Tang, C.; Luktarhan, N.; Zhao, Y. SAAE-DNN: Deep Learning Method on Intrusion Detection. Symmetry 2020, 12, 1695. [Google Scholar] [CrossRef]
- Thapa, N.; Liu, Z.; Kc, D.B.; Gokaraju, B.; Roy, K. Comparison of Machine Learning and Deep Learning Models for Network Intrusion Detection Systems. Future Internet 2020, 12, 167. [Google Scholar] [CrossRef]
- Papamartzivanos, D.; Marmol, F.G.; Kambourakis, G. Introducing Deep Learning Self-Adaptive Misuse Network Intrusion Detection Systems. IEEE Access 2019, 7, 13546–13560. [Google Scholar] [CrossRef]
- Kasongo, S.M.; Sun, Y. A Deep Learning Method with Filter Based Feature Engineering for Wireless Intrusion Detection system. IEEE Access 2019, 7, 38597–38607. [Google Scholar] [CrossRef]
- Anderson, J.P. Computer Security Threat Monitoring and Surveillance; James P. Anderson Co.: Fort Washington, MA, USA, 1980. [Google Scholar]
- Bolton, R.J.; Hand, D.J. Statistical fraud detection: A review. Oper. Res. 2004, 17, 235–255. [Google Scholar]
- Kou, Y.; Lu, C.T.; Sirwongwattana, S. Survey of fraud detection techniques. In Proceedings of the IEEE International Conference on Networking, Taipei, Taiwan, 21–23 March 2004. [Google Scholar]
- Jokar, P.; Arianpoo, N.; Leung, V.C.M. Electricity Theft Detection in AMI Using Customers’ Consumption Patterns. IEEE Trans. Smart Grid 2017, 7, 216–226. [Google Scholar] [CrossRef]
- Alseiari, F.A.A.; Aung, Z. Real-time anomaly-based distributed intrusion detection systems for advanced Metering Infrastructure utilizing stream data mining. In Proceedings of the International Conference on Smart Grid & Clean Energy Technologies, Offenburg, Germany, 14–15 October 2015. [Google Scholar]
- Vijayanand, R.; Devaraj, D.; Kannapiran, B. Support vector machine based intrusion detection system with reduced input features for advanced metering infrastructure of smart grid. In Proceedings of the 4th International Conference on Advanced Computing and Communication Systems, Coimbatore, India, 1–7 January 2017. [Google Scholar]
- Jindal, A.; Dua, A.; Kaur, K. Decision Tree and SVM-Based Data Analytics for Theft Detection in Smart Grid. IEEE Trans. Ind. Inform. 2016, 12, 1005–1016. [Google Scholar] [CrossRef]
- Yuancheng, L.; Rixuan, Q.; Sitong, J. Intrusion detection system using Online Sequence Extreme Learning Machine (OS-ELM) in advanced metering infrastructure of smart grid. PLoS ONE 2018, 13, e0192216. [Google Scholar]
- Boumkheld, N.; Ghogho, M.; Koutbi, M.E. Intrusion detection system for the detection of blackhole attacks in a smart grid. In Proceedings of the 4th International Symposium on Computational and Business Intelligence, Olten, Switzerland, 5–7 September 2016. [Google Scholar]
- Jokar, P.; Leung, V. Intrusion Detection and Prevention for ZigBee-Based Home Area Networks in Smart Grids. IEEE Trans. Smart Grid 2016, 9, 1800–1811. [Google Scholar] [CrossRef]
- Almakrami, H. Intrusion detection system for smart meters. In Proceedings of the 2016 Saudi Arabia Smart Grid, Jeddah, Saudi Arabia, 5–7 December 2016. [Google Scholar]
- Khan, I.A.; Pi, D.; Khan, Z.U. HML-IDS: A Hybrid-Multilevel Anomaly Prediction Approach for Intrusion Detection in SCADA Systems. IEEE Access 2019, 7, 89507–89521. [Google Scholar] [CrossRef]
- He, Y.; Mendis, G.J.; Wei, J. Real-Time Detection of False Data Injection Attacks in Smart Grid: A Deep Learning-Based Intelligent Mechanism. IEEE Trans. Smart Grid 2017, 8, 2505–2516. [Google Scholar] [CrossRef]
- Zheng, Z.; Yatao, Y.; Niu, X. Wide & Deep Convolutional Neural Networks for Electricity-Theft Detection to Secure Smart Grids. IEEE Trans. Ind. Inform. 2017, 14, 1606–1615. [Google Scholar]
- Ullah, A.; Javaid, N.; Omaji, S. CNN and GRU based Deep Neural Network for Electricity Theft Detection to Secure Smart Grid. In Proceedings of the 2020 International Wireless Communications and Mobile Computing, Limassol, Cyprus, 15–19 June 2020. [Google Scholar]
- Liu, G.; Zhang, J. CNID: Research of Network Intrusion Detection Based on Convolutional Neural Network. Discret. Dyn. Nat. Soc. 2020, 1, 1–12. [Google Scholar] [CrossRef]
- Xiao, Y.; Xing, C.; Zhang, T. An Intrusion Detection Model Based on Feature Reduction and Convolutional Neural Networks. IEEE Access 2019, 7, 42210–42219. [Google Scholar] [CrossRef]
- Yang, H.; Wang, F. Wireless Network Intrusion Detection Based on Improved Convolutional Neural Network. IEEE Access 2019, 7, 64366–64374. [Google Scholar] [CrossRef]
- Shen, Y.; Zheng, K.; Wu, C. An Ensemble Method based on Selection Using Bat Algorithm for Intrusion Detection. Comput. J. 2018, 61, 526–538. [Google Scholar] [CrossRef]
- Zhang, K.; Hu, Z.; Zhan, Y.; Wang, X.; Guo, K. A Smart Grid AMI Intrusion Detection Strategy Based on Extreme Learning Machine. Energies 2020, 13, 4907. [Google Scholar] [CrossRef]
- Staudemeyer, R.C. Applying long short-term memory recurrent neural networks to intrusion detection. South. Afr. Comput. J. 2015, 56, 136–154. [Google Scholar] [CrossRef]
- Kim, J.; Thu, H.L.T. Long Short Term Memory Recurrent Neural Network Classifier for Intrusion Detection. In Proceedings of the International Conference on Platform Technology & Service, Jeju, Korea, 15–17 February 2016. [Google Scholar]
- Congyuan, X.; Jizhong, S.; Xin, D. An Intrusion Detection System Using a Deep Neural Network with Gated Recurrent Units. IEEE Access 2018, 6, 48697–48707. [Google Scholar]
- Hasan, N.; Toma, R.N.; Nahid, A.-A.; Islam, M.M.; Kim, J.-M. Electricity Theft Detection in Smart Grid Systems: A CNN-LSTM Based Approach. Energies 2019, 12, 3310. [Google Scholar] [CrossRef] [Green Version]
- Wang, W.; Sheng, Y.; Wang, J. HAST-IDS: Learning Hierarchical Spatial-Temporal Features Using Deep Neural Networks to Improve Intrusion Detection. IEEE Access 2018, 6, 1792–1806. [Google Scholar] [CrossRef]
- Vinayakumar, R.; Soman, K.P.; Poornachandran, P. Applying convolutional neural network for network intrusion detection. In Proceedings of the International Conference on Advances in Computing, Communications and Informatics, Karnataka, India, 13–16 September 2017. [Google Scholar]
- LeCun, Y.; Bengio, Y.; Hinton, G. Deep learning. Nature 2015, 521, 436–444. [Google Scholar] [CrossRef] [PubMed]
- Javaid, A.Y.; Niyaz, Q.; Sun, W. A Deep Learning Approach for Network Intrusion Detection System. In Proceedings of the 9th EAI International Conference on Bio-Inspired Information and Communications Technologies, New York, NY, USA, 3–5 December 2015. [Google Scholar]
- Tavallaee, M.; Bagheri, E.; Lu, W. A detailed analysis of the KDD CUP 99 data set. In Proceedings of the IEEE Symposium on Computational Intelligence for Security and Defense Applications, Ottawa, ON, Canada, 8–10 July 2009. [Google Scholar]
- Shilpa, L.; Sini, J.; Bhupendra, V. Feature Reduction using Principal Component Analysis for Effective Anomaly–Based Intrusion Detection on NSL-KDD. Int. J. Eng. Sci. Technol. 2010, 2, 1790–1799. [Google Scholar]
- Kumar, V.; Chauhan, H.; Panwar, D. K-Means Clustering Approach to Analyze NSL-KDD Intrusion Detection Dataset. Int. J. Soft Comput. Eng. 2013, 3, 1–4. [Google Scholar]
- Al-Daweri, M.S.; Zainol Ariffin, K.A.; Abdullah, S. An Analysis of the KDD99 and UNSW-NB15 Datasets for the Intrusion Detection System. Symmetry 2020, 12, 1666. [Google Scholar] [CrossRef]
- Zhan, X.; Yuan, H.; Wang, X. Research on Block Chain Network Intrusion Detection System. In Proceedings of the 2019 International Conference on Computer Network, Electronic and Automation, Xi’an, China, 27–29 September 2019. [Google Scholar]
Type of Label | 10%KDD Cup 99 | Training Set | Test Set | |||
---|---|---|---|---|---|---|
Quantity | Ratio (%) | Quantity | Ratio (%) | Quantity | Ratio (%) | |
Normal | 97,277 | 19.69 | 87,467 | 19.67 | 9813 | 19.86 |
Dos | 391,458 | 79.24 | 352,405 | 79.26 | 39,053 | 79.06 |
Probing | 4107 | 0.83 | 3685 | 0.83 | 422 | 0.85 |
R2L | 1126 | 0.23 | 1018 | 0.23 | 108 | 0.22 |
U2R | 52 | 0.01 | 45 | 0.01 | 7 | 0.01 |
Total | 494,020 | 100 | 444,617 | 100 | 49,403 | 100 |
Type of Label | NSL-KDD | Training Set | Test Set | |||
---|---|---|---|---|---|---|
Quantity | Ratio (%) | Quantity | Ratio (%) | Quantity | Ratio (%) | |
Normal | 67,343 | 53.46 | 60,659 | 53.50 | 6684 | 53.05 |
Dos | 45,927 | 36.46 | 41,323 | 36.45 | 4604 | 36.55 |
Probing | 11,656 | 9.25 | 10,461 | 9.23 | 1195 | 9.49 |
R2L | 995 | 0.79 | 884 | 0.78 | 111 | 0.88 |
U2R | 52 | 0.04 | 48 | 0.04 | 4 | 0.03 |
Total | 125,973 | 100 | 113,375 | 100 | 12,598 | 100 |
Type of Label | Numerical Result |
---|---|
Normal | 0 |
Dos | 1 |
Probing | 2 |
R2L | 3 |
U2R | 4 |
Project | Environment/Version |
---|---|
Operating System | Windows 10 |
CPU | i7-10700 |
Memory | 32 G |
GPU | GTX 2070 Super |
Development Environment | Spyder3.0 (Python3.6) |
Hyper-Parameter | Filter/Neurons |
---|---|
Conv + ReLU | 8/16 |
LSTM hidden nodes | 80 |
LSTM activation function | ReLU |
Dense (Conv/LSTM) | 128 |
Dense | 256 |
Softmax | 5 |
Cost function | Cross entropy |
Batch size | 128 |
Epoch | 100 |
Systems | KDD Cup 99 | NSL-KDD | ||||
---|---|---|---|---|---|---|
Accuracy (%) | DR (%) | FPR (%) | Accuracy (%) | DR (%) | FPR (%) | |
AE-CNN [32] | 93.99 | 77.94 | 6.82 | / | / | / |
LSTM [36] | 94.11 | 77.07 | 0.18 | / | / | / |
LSTM-RNN [37] | 96.93 | 98.88 | 10.04 | / | / | / |
GA-ELM [35] | 98.90 | 99.16 | 1.36 | / | / | / |
CNN-LSTM [41] | 99.70 | 99.60 | / | / | / | / |
ELM [34] | 98.94 | 98.37 | 0.72 | 97.58 | 97.69 | 2.22 |
ICNN [33] | / | / | / | 95.36 | 96.99 | 0.76 |
CNN [31] | / | / | / | 97.07 | 97.14 | 0.87 |
Proposed | 99.95 | 99.91 | 0.03 | 99.79 | 99.92 | 0.34 |
Publisher’s Note: MDPI stays neutral with regard to jurisdictional claims in published maps and institutional affiliations. |
© 2021 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (http://creativecommons.org/licenses/by/4.0/).
Share and Cite
Yao, R.; Wang, N.; Liu, Z.; Chen, P.; Sheng, X. Intrusion Detection System in the Advanced Metering Infrastructure: A Cross-Layer Feature-Fusion CNN-LSTM-Based Approach. Sensors 2021, 21, 626. https://doi.org/10.3390/s21020626
Yao R, Wang N, Liu Z, Chen P, Sheng X. Intrusion Detection System in the Advanced Metering Infrastructure: A Cross-Layer Feature-Fusion CNN-LSTM-Based Approach. Sensors. 2021; 21(2):626. https://doi.org/10.3390/s21020626
Chicago/Turabian StyleYao, Ruizhe, Ning Wang, Zhihui Liu, Peng Chen, and Xianjun Sheng. 2021. "Intrusion Detection System in the Advanced Metering Infrastructure: A Cross-Layer Feature-Fusion CNN-LSTM-Based Approach" Sensors 21, no. 2: 626. https://doi.org/10.3390/s21020626