Intrusion detection of NSM based DoS attacks using data mining in smart grid

Kyung Choi, Xinyi Chen, Shi Li, Mihui Kim, Kijoon Chae, Jung Chan Na

Research output: Contribution to journalArticlepeer-review

31 Scopus citations


In this paper, we analyze the Network and System Management (NSM) requirements and NSM data objects for the intrusion detection of power systems; NSM is an IEC 62351-7 standard. We analyze a SYN flood attack and a buffer overflow attack to cause the Denial of Service (DoS) attack described in NSM. After mounting the attack in our attack testbed, we collect a data set, which is based on attributes for the attack. We then run several data mining methods with the data set using the Waikato Environment for Knowledge Analysis (WEKA). In the results, we select the decision tree algorithms with high detection rates, and choose key attributes in high level components of the trees. When we run several data mining methods again with the data set of chosen key attributes, the detection rates of most data mining methods are higher than before. We prove that our selected attack attributes, and the proposed detection process, are efficient and suitable for intrusion detection in the smart grid environment.

Original languageEnglish
Pages (from-to)4091-4109
Number of pages19
Issue number10
StatePublished - Oct 2012


  • Data mining
  • Denial of service (DoS) attack
  • Intrusion detection
  • Network and system management (NSM)
  • Smart grid


Dive into the research topics of 'Intrusion detection of NSM based DoS attacks using data mining in smart grid'. Together they form a unique fingerprint.

Cite this