Enhanced cybersecurity for smart grids: Detecting protocol-specific DDoS attacks on Modbus networks

Abstract

Smart grid (SG) infrastructure is critical in developing distributed energy networks. However, the increase in communication among the several entities of the SG also leads to an increase in vulnerabilities. Among the several attacks, Distributed Denial of Service (DDoS) is the most common threat that can disrupt the normal functioning of SGs, causing instability and severe security issues across the entire grid. While many researchers have explored Machine Learning (ML) and Deep Learning (DL) solutions to enhance SG security, most of them detect DDoS attacks using datasets that do not include SG-specific protocols, such as the Modicon Communication Bus (Modbus) protocol. The proposed study presents a novel contribution by generating a Modbus-specific DDoS attack dataset for SG environments and applying a DL Sparse AutoEncoder (SAE)-based method to detect such attacks. The experimental results show that the proposed model detects DDoS attacks in the SG network with an Accuracy of 76%, compared to state-of-the-art methods such as Random Forest (RF), Convolutional Neural Network (CNN), and Gated Recurrent Unit (GRU), with Accuracies of 73% and 71%, respectively.