Anomaly extraction and correlations for power infrastructure cyber systems

There has not been an organized way to efficiently correlate anomaly behaviors in critical infrastructures as information about malicious activities are not gathered from geographically dispersed cyber systems. This paper establishes a systematic approach to identify properties that can be extracted to detect malicious activities in the cyber-based control systems. The malicious detection can be implemented through an on-line anomaly inference system in order to improve situational awareness. In this preliminary investigation, a methodology to infer anomaly is proposed for power systems, representing the anomalous cyber- or power-related events among substation networks.