Automated detection and localization of measurement and time anomalies in IEC 60870-5-104 SCADA records

Abstract:
SCADA systems are critical for managing critical infrastructures such as energy, water, and gas supply. They play a crucial role for energy management and the operation of power systems. Thus, the analysis and protection of SCADA data are vital to ensure safe and reliable operations, helping to prevent economic losses, environmental disasters, and human casualties. To address these challenges, we introduce a machine learning ensemble model to detect measurement and time anomalies in SCADA records. This model computes anomaly scores for multiple RTUs over different measurement channels and timestamps. We demonstrate our approach by analyzing SCADA messages incorporating synthetic measurement anomalies (like white noise or sign shifts) and time anomalies (such as forward or backward shifts). Our evaluation is conducted using real-time simulations of the IEEE 9-bus power system in OPAL-RT. The results indicate that reconstruction-based models significantly outperform forecasting-based and classification-based models. Further details about the influence of relevant hyperparameters and dif-ferent detection configurations are presented.