Publication Details

Accurate Automata-Based Detection of Cyber Threats in Smart Grid Communication

HAVLENA Vojtěch, MATOUŠEK Petr, RYŠAVÝ Ondřej and HOLÍK Lukáš. Accurate Automata-Based Detection of Cyber Threats in Smart Grid Communication. IEEE Transactions on Smart Grid, vol. 2022, no. 1, pp. 1-14. ISSN 1949-3053. Available from:
Czech title
Použití automatů pro přesnou detekci kybernetických hrozeb v komunikaci chytrých rozvodných sítí
journal article

Smart grid, cyber security, anomaly detection, probabilistic automata, network flows, MITRE ATT&CK


Several industry sectors, including critical infrastructure, have experienced severe cyber attacks against their Industrial Control  Systems (ICS) due to the malware that masqueraded itself as a legitimate ICS process and communicated with valid ICS messages. Such behavior is difficult to detect by standard techniques. Intrusion Detection Systems (IDS) usually filter illegitimate communication using pre-defined patterns while statistical-based Anomaly Detection Systems (ADS) mostly observe selected attributes of transmitted packets without deeper analysis of ICS messages.

We propose a new detection approach based on Deterministic Probabilistic Automata (DPAs) that capture the intended semantics of the ICS message exchange. The method models normal ICS message sequences using a set of DPAs representing expected traffic patterns. Then the detection system applies reasoning about the model to reveal a malicious activity in the ICS traffic expressed by unexpected ICS messages. In this paper, we significantly improve the performance of the automata-based detection method and reduce its false-positive rate. We also present a technique that produces additional details about detected anomalies, which is important for real-world deployment. The approach is demonstrated on IEC 104 or MMS communication from different ICS systems.

IEEE Transactions on Smart Grid, vol. 2022, no. 1, ISSN 1949-3053
Institute of Electrical and Electronics Engineers
EID Scopus
   author = "Vojt\v{e}ch Havlena and Petr Matou\v{s}ek and Ond\v{r}ej Ry\v{s}av\'{y} and Luk\'{a}\v{s} Hol\'{i}k",
   title = "Accurate Automata-Based Detection of Cyber Threats in Smart Grid Communication",
   pages = "1--14",
   journal = "IEEE Transactions on Smart Grid",
   volume = 2022,
   number = 1,
   year = 2022,
   ISSN = "1949-3053",
   doi = "10.1109/TSG.2022.3216726",
   language = "english",
   url = ""
Back to top