Self-Organizing Maps (SOM) can provide a visualization for multi-dimensional data with two dimensional mappings. By applying unsupervised learning techniques to SOM representations, we can further enhance visual inspection for change detection. In order to obtain a more accurate measurement for the changes of self-organizing maps beyond simple visual inspection, we introduce the Gaussian Mixture Model (GMM) and Kullback-Leibler Divergence (KLD) on top of SOM trained maps. The main contribution in this dissertation focuses on adding numerical methods to SOM algorithms, with anomaly detection as example domain. Through extensive traced-based simulations, it is observed that our techniques can uncover anomalies with an accuracy of 100% at an anomaly mixture-rate as low as 12% from the CTU-13 dataset. Tuning of the KLD threshold further reduces the mixture-rate to 7%, significantly augmenting visual inspection to assist in detecting low-rate anomalies. Suitable hierarchical and distributed SOM-based approaches are also explored, along with other approaches in the literature. Hierarchies in SOM can show the correlations among the neural cells on the self-organizing maps. In order to obtain a higher accuracy for anomaly detection, a new dimension of labels is suggested to be added in the second layer of SOM training. Also for more general distributed SOM-based algorithms, we investigate the use of principal component analysis (PCA) for the separation of dimensions. With the transformed dataset from PCA, the inner dependencies can be reserved in a manageable scale. As a case study, this dissertation uses a SOM-based approach for anomaly detection in Supervisory Control And Data Acquisition (SCADA) networks. We further investigate the use of SOM for the Quality of Service (QoS) in the scenario of wireless SCADA networks. Solving the problem of long computing time of optimizing the cached contents, the new SOM-based approach can also learn and predict the sub-optimal locations for the caching while maintaining a prediction error of 28%. / Graduate

El Complejo Hidroeléctrico del Mantaro es la central hidroeléctrica más grande del Perú, cuya labor principal es la generación de energía eléctrica, siendo esta la pionera y en la actualidad la más importante fuente de generación eléctrica de la toda Región Central; debido a ello se requiere mantener constante un cierto volumen de agua para obtener el caudal necesario para la generación de energía eléctrica, de acuerdo a la demanda energética, en todas las épocas del año. Es aquí donde surge la necesidad de contar permanentemente con datos de información climática y a la vez recurrir a potenciales reservorios naturales de agua, los cuales serán utilizados en épocas de sequía o estiaje para mantener un volumen estándar y generar la misma potencia promedio todo el año. Para ello la empresa de Electricidad del Perú ELECTROPERU S.A., propietaria de las centrales hidroeléctricas que conforman el Complejo Hidroeléctrico del Mantaro, actualmente cuenta con estaciones hidrometeorológicas dispersas a lo largo de toda la Cuenca del Mantaro, lagunas reguladas y lagunas por regular en los diferentes departamentos de la sierra central del país. Es por ello que es imprescindible requerir de una Red de Telemetría para el envío automático y en tiempo real de la información climática captada por las estaciones hidrometeorológicas, así mismo para el monitoreo a distancia tanto de las estaciones hidrometeorológicas como de las estaciones de lagunas reguladas, y también para permitir el envío de órdenes a distancia tanto de apertura y cierre de las compuertas de retención de agua, las cuales funcionarán en forma automática. Por lo mencionado anteriormente, el presente trabajo de tesis pretende realizar el diseño de la Red de Telemetría más conveniente y que satisfaga los requerimientos mencionados, tomando en cuenta estaciones existentes y futuros proyectos a nivel de pre-factibilidad y factibilidad para la regulación de un mayor número de lagunas de tal empresa. Para esto se desarrollarán cuatro capítulos: el primero será dedicado al marco teórico y aspectos tecnológicos de la red, el segundo a la determinación de necesidades para el diseño de la Red, en el tercero se desarrollará la ingeniería del proyecto, y finalmente en el cuarto se presentarán las conclusiones y recomendaciones. / Tesis

The demand for electric load in recent years has been growing consistently in Taiwan. Besides supplying the load demand, the electricity service of distribution systems has to be reliable to meet the power quality of high tech industry. For a fault contingency in distribution systems, the fault location has to be identified and isolated by operating the boundary line switches. The electricity service for the un-faulted but outaged area has to be restored by transfering the loading to the neighboring feeders. The service reliability of distribution systems, a comprehensive distribution automation system DAS is implemented by integrating the computer master station, the communication system and the remote controlling equipments. The master station of DAS system to perform the function of fault detection, isolation and restoration (FDIR) can accelerate the process of service restoration for fault contingency. To support the topology process of distribution system network, the outage management system (OMS), which has also been installed in all Taipower districts to store the attributes of distribution components, has been applied in this study. The operating mapping system is created to support distribution system operation by retrieving the static data from the OMS system and the dynamic data of line switch status from the real time database (RTDB). By this way, the distribution system network is updated by executing the network topology processor according to the operation of line switches. In this thesis, a rule-based expert system is developed for fault restoration of distribution systems. To assure the proposed switch operation plan for fault restoration can comply with the distribution system operation regulation in Taipower, all of the feeders with open the switch to each feeder are formulated as a supporting group. The reserve capacity of each supporting feeders is used to compare the loading of unfaulted but outaged sections for downstream restoration. Based on the embeded rule base in the application program, the op line switch plan for fault restoration can therefore be derived for dispatchers engineers to restore the service in a short time period. Besides the FDIR function, the application software can also be used to derive the optimal switching operation for loading balance of distribution feeders to enhance the operation efficiency of distribution systems.

With the application of high tech equipments in the industrial, commercial, and residential areas, the enhancement of power quality has become a very critical issue for power utilities. Distribution automation and customer automation will be the most important functions to be implemented. Distribution automation consists of control center, communication system, remote terminal units, and feeder terminal units. The currents, voltages, phase angles, and switch status will be collected by the real time SCADA system. Based on the switch status and connectivity analysis, the distribution network configuration can be identified by executing the topology process. The distribution system planning and optimal operation strategy can be achieved by various application software functions. A multiagent-based distribution automation system is developed for fault detection, isolation, and restoration (FDIR) of distribution systems with JADE platform in this thesis. Remote terminal unit (RTU) agents, main transformer (MTR) agents, feeder circuit breaker (FCB) agents, and feeder terminal unit (FTU) agents of the multiagent system (MAS) are proposed to derive a proper restoration plan after a faulted location has been identified and isolated. To ensure the fault restoration plan can comply with the operation regulation, heuristic rules based on the standard operation procedures of Taipower distribution system are included in the best first search of the MAS. For the fault contingency during summer peak season, the load shedding may be executed and the MAS are designed to restore service to as many key customers and loads as possible. The priority indices of each feeder and service zone are determined according to the key customers within the service territory. A Taipower distribution system with 43 feeders is selected for computer simulation to demonstrate the effectiveness of the proposed methodology in this thesis. It is found that the service restoration of distribution system can be obtained very efficiently by applying the proposed multiagent-based MAS.

The use of rollback is a fundamental flaw in some existing distributed control systems because the advance in time and in external world situations means that what had been a correct state in the past may no longer be a correct state in real time and distributed systems. In such systems rollback is not restoring to a state that is consistent with the current external environment. Forward error recovery provides a potential solution to such a situation to handle exception rather than backward recovery. A contingency is an unusual but anticipated situation for which the normal flow of instructions would not produce the appropriate results that should be expected. We will discuss how to handle contingencies and exceptions in a SCADA (Supervisory Control and Data Acquisition) system using resumption and termination models of exception handling.

A SCADA system employing the distributed networks of sensors and actuators that interact with the physical environment is vulnerable to attacks that target the interface between the cyber and physical subsystems. An attack that hijacks the sensors in an attempt to provide false readings to the controller (for example, the Stuxnet worm that targeted Iran’s nuclear centrifuges) can be used to feign normal system operation for the control system, while the attacker can hijack the actuators to send the system beyond its safety range. This thesis extends the results of a previously proposed method. The original method proposed addition of a randomized “watermarking” signal and checking for the presence of this signal and its effects in the received sensor measurements. Since the control inputs traverse the cyberphysical boundary and make their effects apparent in the sensor measurements, they are employed to carry this watermarking signal through to the system and back to the SCADA controller. The sensor measurements are compared to the expected measurements (calculated using a suitably delayed model of the system within the controller). This methodology is based on using the statistics of the linear system and its controller. The inclusion of a randomized signal on the control inputs induces an increase in the performance cost of the physical system. This thesis proposes a method of optimization of the watermarking signal based on the trade-off between this performance cost and the attack detection rate, by leveraging the distribution the watermarking signal over multiple inputs and multiple outputs. It is further proved that regardless of the number of inputs and outputs in the system, only one watermarking signal needs to be generated. This optimization, and its necessity in improving the effectiveness of the detector without detriment to the performance cost, are demonstrated on a simulated chemical plant. The thesis also proposes another methodology that does not rely on these statistics, but is instead based on calculating the correlation between the received sensor measurements and the expected measurements accrued from the model inside the controller. Generalizing the form of attack even further to attacks that target the integrity of the data sent to the actuators and received from the sensors, this thesis demonstrates the effect of such integrity attack on electricity market operations, where the attacker successfully uses a vulnerability in the Global Position System to break synchronicity among dispersed phasor measurements to gain a competitive advantage over other bidders in the electricity market. In an effort to make state estimation robust against integrity attacks, the sensors and states are modeled as binary variables. Sensor networks use binary measurements and state estimations for several reasons, including communication and processing overheads. Such a state estimator is vulnerable to attackers that can hijack a subset of the sensors in an effort to change the state estimate. This thesis proposes a method for designing the estimators using the concept of invariant sets. This methodology relies on identifying the sets of measurement vectors for which no amount of manipulation by the attacker can change estimate, and maximizing the probability that the sensor measurement vector lies in this set. Although the problem of finding the best possible invariant sets for a general set of sensors has double-exponential complexity, by using some simplifications on the types of sensors, this can be reduced significantly. For the problem that employs all sensors of the same type, this method reduces to a linear search. For sensors that can be classified into two types, this complexity reduces to a search over a two-dimensional space, which is still tractable. Further increase in the confidence of the estimate can be achieved by considering the correlation between the sensor measurements.

This research project discusses the life-cycle analysis of wind turbines through the processing of operational data from two modern European wind farms. A methodology for SCADA data processing has been developed combining previous research findings and in-house experience followed by statistical analysis of the results. The analysis was performed by dividing the wind turbine into assemblies and the failures events in severity categories. Depending on the failure severity category a different statistical methodology was applied, examining the reliability growth and the applicability of the “bathtub curve” concept for wind turbine reliability analysis. Finally, a methodology for adapting the results of the statistical analysis to site-specific environmental conditions is proposed.

La presente investigación, está orientada a mejorar el control de la producción de una planta de envases de hojalata para leche evaporada, monitoreando y almacenando la información de la producción de todas las etapas del proceso de fabricación de envases. Obtener indicadores reales en una planta de producción en masa sin un sistema electrónico de monitoreo y almacenamiento de datos, es una tarea imposible para una industria, los indicadores de producción y mantenimiento cuantifican a través de cifras numéricas el estado real de la planta y la disponibilidad de las líneas de producción. La problemática de toda planta de producción, radica en que no existe veracidad de los indicadores de producción y mantenimiento que no permiten desarrollar programas de producción adecuados como también los alcances de las líneas de producción no pueden ser definidos. El hecho de no tener un control de la materia prima que ingresa comparado con la materia prima que sale como envase conformado, trae como consecuencia perdidas monetarias para la empresa, puesto que no se conoce la causa raíz del porque el material de desecho es elevado (merma), las causas pueden ser muchas entre las importantes tenemos fallas del personal de producción y mantenimiento, fallas ocultas en las líneas de producción, fallas del material que se consume de los proveedores, etc. Para incrementar los niveles de producción en una planta se debe tener buen tiempo de producción, buena calidad en los productos y buena disponibilidad de las líneas, si uno de estos factores falla se traduce en pérdidas de dinero que afectan directamente a la empresa, incrementando el precio de coste del producto terminado el cual debe ser disminuido para generar mayores ventas en el mercado y por consecuencia mayores ingresos para la empresa. Para solucionar estos problemas ocultos en una planta de producción de envases se desarrolló un sistema de monitoreo, almacenamiento y gestión de datos, con una red PLC maestro y ET esclavo de la familia Siemens, usando sensores inductivos para el monitoreo de la materia prima de los diferentes niveles de producción. Con la ayuda del software SCADA Indusoft se almacenara constantemente la producción de las líneas, el cual podrá ser observado en las computaras de los supervisores y jefes de la planta, para gestionar la información en el nivel más alto se generara una base de datos en Excel con código Visual Basic para filtrar toda la información del SCADA.

Supervisory Control and Data Acquisition (SCADA) systems control and monitor critical infrastructure in society, such as electricity transmission and distribution systems. Modern SCADA systems are increasingly adopting open architectures, protocols, and standards and being connected to the Internet to enable remote control. A boost in sophisticated attacks against SCADA systems makes SCADA security a pressing issue. An Intrusion Detection System (IDS) is a security countermeasure that monitors a network and tracks unauthenticated activities inside the network. Most commercial IDSs used in general IT systems are signature-based, by which an IDS compares the system behaviors with known attack patterns. Unfortunately, recent attacks against SCADA systems exploit zero-day vulnerabilities in SCADA devices which are undetectable by signature-based IDSs. This thesis aims to enhance SCADA system monitoring by anomaly detection that models normal behaviors and finds deviations from the model. With anomaly detection, zero-day attacks are possible to detect. We focus on modeling the timing attributes of SCADA traffic for two reasons: (1) the timing regularity fits the automation nature of SCADA systems, and (2) the timing information (i.e., arrival time) of a packet is captured and sent by a network driver where an IDS is located. Hence, it’s less prone to intentional manipulation by an attacker, compared to the payload of a packet. This thesis first categorises SCADA traffic into two groups, request-response and spontaneous traffic, and studies data collected in three different protocol formats (Modbus, Siemens S7, and IEC-60870-5-104). The request-response traffic is generated by a polling mechanism. For this type of traffic, we model the inter-arrival times for each command and response pair with a statistical approach. Results presented in this thesis show that request-response traffic exists in several SCADA traffic sets collected from systems with different sizes and settings. The proposed statistical approach for request-response traffic can detect attacks having subtle changes in timing, such as a single packet insertion and TCP prediction for two of the three SCADA protocols studied. The spontaneous traffic is generated by remote terminal units when they see significant changes in measurement values. For this type of traffic, we first use a pattern mining approach to find the timing characteristics of the data. Then, we model the suggested attributes with machine learning approaches and run it on traffic collected in a real power facility. We test our anomaly detection model with two types of attacks. One causes persistent anomalies and another only causes intermittent ones. Our anomaly detector exhibits a 100% detection rate with at most 0.5% false positive rate for the attacks with persistent anomalies. For the attacks with intermittent anomalies, we find our approach effective when (1) the anomalies last for a longer period (over 1 hour), or (2) the original traffic has relatively low volume.

This master's thesis deals with systems which are used for supervisory control and data acquisition. The theoretical part concerns with the single systems and their comparison. The practical section describes the designed program for control of smart wiring FOXTROT. The visualization and its remote control were created in this program. The result of practical part is a lab manual.