Cyber security analysis in energy transmission, control and management systems by using feature selection and machine learning

A recorded it is expected from systems which transmit, control and manage the energy like SCADA to operate by being connected to internet networkand transmit data from network securely. It is possible to develop smart systems that protect energy control and management systems by classifyingerrors on data as a result of cyber-attacks to the system. However, in the smart classifying algorithms which will be developed for large scalesystems, the biggest problem is that the feature space is so large. For these systems, it is important to reduce features correctly. In this study, it is aimed to investigate the effects of sequentially connected feature selection algorithms to the consumed time and classification performance. Thus, the system performance will be investigated with the feature matrices that are acquired after each feature selection. An open source dataset which consists of 128 different transmission line measurement parameters' feature space were used for the developed algorithm. The methodology of the study has 4 main steps. In each step, multi-layer perceptron (MLP) which has quintet committee structure, decides by majority of votes, has constant parameter (number of layer and neuron, learning rate and momentum coefficient) was preferred and ten-fold crossvalidation was applied. For the first step, all dataset was classified directly with MLP network. Performance and classification times were recorded. For the second step, ANOVA analysis was used as the first feature selection method and the features which have p-value greater than 0.05 were eliminated. The feature matrix which was acquired after the first feature selection was classified with the same MLP network. Performance and training duration were recorded. In the third step, correlation was examined among features. By starting with the lowest p-valued feature, features that have correlation coefficients lesser than 0.7 were selected with this method and were inserted into the classification algorithm. Performance and consumed time wererecorded. For the last feature selection method, features were sorted by weighting according to the relation among them with ReliefF algorithm. From the acquired sorted features, the mean value of the features that have minimum and maximum value were calculated. The features that have greaterweight value than mean value were inserted into the classification process. When the results are examined, MLP network faced with overlearning problem for the whole dataset and it couldn't classify any of two classes. The classification performance was 21% and training time was observed approximately as 63.14 seconds. After the first feature selection, number offeatures decreased from 128 to 82. The classification performance was 89.11% and training time was nearly 205.82 seconds. Twenty four featureswere suitable for classification after second feature selection which was carried our according to correlation coefficients. The classification performancewas obtained as 85.32% and process duration was 17.69 seconds with these features. After the last feature selection, the number of features dropped to 6 and classification duration was 7.4 seconds. The classification performance was 84.49%.