# Gaussian Mixture Modeling for Detecting Integrity Attacks in Smart Grids
## 1 Introduction  
Modern critical infrastructures (CI) rely on advanced information and communication technologies (ICT) which have an important role in their monitoring and control. CIs are assets of high importance to the society, such as electricity networks including generation, transmission and distribution, gas network for production, transportation and distribution, financial services (banking, clearing), transportation systems (fuel supply, railway network, airports, harbours, inland shipping), etc. Typically, an ICT layer is employed since it improves the control of the CI leading to better performance while reducing the operational cost. Controlling a CI by means of an ICT framework aims at (a) production profit maximization; (b) satisfying the service demand while ensuring that the parameters of the underlying process are within predetermined limits; and (c) achieving the required operational performance while preventing the occurrence of any type of undesirable behavior. In principle, each CI should employ its own ICT infrastructure to maximize security. However, in practice, the tendency is to share the ICT layer for minimizing the cost of installation, operation, maintenance, etc. [1; 2; 3]. The specific advantage comes with the drawback of increased vulnerability since a successful attack on the ICT layer may provide control to multiple CIs. The main type of cyber threats occur on Supervisory Control And Data Acquisition (SCADA) systems [4; 5]. A recent paradigm is the Stuxnet worm [6] which compromised industrial control systems. Even though cyber attacks are not common, they have a hazardous socioeconomic impact [7]. There have been several recentcyber attacks with very unfortunate consequences, such as (a) in August 2012, the Saudi oil giant Aramco was subjected to a large cyber attack [8] that affected about 30,000 workstations; (b) in April 2012, the big payment processing provider Global Payments confirmed a massive breach [9] that compromised about 1.5 million cards; (c) in January 2013, the U.S. Department of Energy underwent an intrusion [10] to 14 of its servers and many workstations located at the Department's headquarters, aimed at exfiltrating personal information about its employees; and (d) a very recent attack [11] that lasted two years was detected in the Woods Hole Oceanographic Institution. The organization sustained a \"sophisticated, targeted attack\" which has resulted in the theft of US commercial secrets, potentially sensitive government information, and military data. The present article focusses on detecting integrity attacks occurring in the ICT layer. These can be implemented either by affecting the power grid components/equipment, which are responsible for distribution systems, or by manipulating the exchanging protocol messages in order for the attacker to send malicious data to the field device or the control center operator [12]. There exist different lines of thought in the literature: (a) methods detecting _known time-profiles_, so-called signatures, of intrusions, e.g., [13]; (b) approaches using _countermeasures_, i.e., inserting information in the involved signals for facilitating the detection of cyber attacks [14], and (c) _novelty detection_ algorithms, i.e., algorithms which search for patterns not existing within the nominal data which may comprise evidence of cyber attacks. This work concentrates on the third class which is the most generic one, as it can detect integrity attacks of unknown patterns without increasing the computational complexity of the operation of the system. The first class comes with limited capabilities as the attack should have been previously encountered and recorded, not to mention that an experienced attacker would design a novel kind of attack. In our opinion, it may be used as the first line of defence.