Due to its crucial role in identity and access management in modern enterprise networks, Active Directory (AD) is a top target of Advanced Persistence Threat (APT) actors. Conventional intrusion detection systems (IDS) excel at identifying malicious behaviors caused by malware, but often fail to detect stealthy attacks launched by APT actors. Recent advance in provenance-based IDS (PIDS) shows promises by exposing malicious system activities in causal attack graphs. However, existing approaches are restricted to intra-machine tracing, and unable to reveal the scope of attackers' traversal inside a network. We proposeHADES, the first PIDS capable of performing accurate causality-based cross-machine tracing by leveraging a novel concept calledlogon session based execution partitioningto overcome several challenges in cross-machine tracing. We designHADESas an efficient on-demand tracing system, which performs whole-network tracing only when it first identifies an authentication anomaly signifying an ongoing AD attack, for which we introduce a novel lightweight authentication anomaly detection model rooted in our extensive analysis of AD attacks. To triage attack alerts, we present a new algorithm integrating two key insights we identified in AD attacks. Our evaluations show thatHADESoutperforms both popular open-source detection systems and a prominent commercial AD attack detector.

In Advanced Persistent Threat (APT) attacks, achieving stealthy persistence within target systems is often crucial for an attacker's success. This persistence allows adversaries to maintain prolonged access, often evading detection mechanisms. Recognizing its pivotal role in the APT lifecycle, this paper introduces Cyber Persistence Detector (CPD), a novel system dedicated to detecting cyber persistence through provenance analytics. CPD is founded on the insight that persistent operations typically manifest in two phases: the “persistence setup” and the subsequent “persistence execution”. By causally relating these phases, we enhance our ability to detect persistent threats. First, CPD discerns setups signaling an impending persistent threat and then traces processes linked to remote connections to identify persistence execution activities. A key feature of our system is the introduction ofpseudo-dependency edges(pseudoedges), which effectively connect these disjoint phases using data provenance analysis, andexpert-guided edges, which enable faster tracing and reduced log size. These edges empower us to detect persistence threats accurately and efficiently. Moreover, we propose a novel alert triage algorithm that further reduces false positives associated with persistence threats. Evaluations conducted on well-known datasets demonstrate that our system reduces the average false positive rate by 93% compared to stateof- the-art methods.

Intrusion detection systems (IDS) have traditionally focused on identifying malicious behaviors caused by malware undertaking a series of suspicious activities within a short time. Facing Advanced Persistent Threat (APT) actors employing the so-called low-and-slow strategy, defenders are often blindsided by the poor performance of these IDS. Provenance-based IDS (PIDS) emerged as a promising solution for reducing false alerts, detecting true attacks, and facilitating attack investigation, by causally linking and contextualizing indicative system activities in provenance graphs. However, most existing PIDS can detect neither multi-phase nor cross-machine APT attacks, enabled by persistence and lateral movement techniques, respectively. In the present work, we propose a new PIDS called Commander , which is, to our knowledge, the first system capable of detecting cross-machine multi-phase APT attacks. Further, Commander targets several evasion attacks that can bypass existing PIDS, making it more robust. In addition, Commander can perform whole network tracing for cross-machine multi-phase APT attacks across an industrial-sector organization, for which we additionally develop parsers for system logs of popular industrial controllers. We also develop detection rules with a reference to MITRE’s knowledge base for industrial control systems . Our evaluations show that Commander accurately detects attacks, outperforms existing detection systems, and delivers succinct and insightful attack graphs.

With the growing trend for developing new detection and investigation systems for Advanced Persistent Threat (APT), the urgent issue of lacking sound and authentic datasets becomes more visible. New datasets for research on APT detection and investigation have been released over the past few years in an accelerated manner. Yet, our examination of the existing datasets yields the finding that the gap between these datasets’ attack scenarios and real-world APT attacks is significant. Recognizing the flaws of prior datasets particularly in terms of attack scenario complexity and authenticity, we develop a novel sound dataset called Aviator, which is backed by MITRE emulation plans. The well-known organization MITRE has released nearly a dozen emulation plans, which closely reproduce APT groups’ real-world attack campaigns observed in the past. However MITRE has not published any datasets. Thus, we resort to stringently implementing these emulation plans. Further, we extend these emulation plans to include an industrial control system and attack steps on it, mimicking APT groups most known for their attacks against critical infrastructures in the past. Comparing to existing datasets, our dataset Aviator has the highest attack scenario complexity and authenticity. Moreover, Aviator is designed with dataset operability, usability, reproducibility and extensibility in mind, for which existing datasets lag far behind. That is, along with the Aviator dataset, we also provide log shipping tools, log parsing tools, and logging configuration files to encourage other researchers to make their own datasets, which may better suit the evaluation of their detection systems. Besides, we would add more log types in future versions of our dataset Aviator. We are committed to maintaining Aviator as a living dataset.

One of the most common and important tasks in control is to maintain a specified constant output value. While constant output is typically achieved for linear time-invariant systems by controlling a state equilibrium, it is also possible to achieve with nonequilibrium state trajectories. These include superpositions with the zero dynamics trajectories, as well as nonequilibrium non-zero-dynamics trajectories. We give a geometric description of the state subspace which allows a constant output. For a nondegenerate system with no invariant zero at s = 0, the subspace is the sum of the equilibrium subspace and the maximal output-nulling subspace. Furthermore, for minimal systems, a stronger statement in the form of a necessary and sufficient condition is given.

Abstract In various applications, probabilistic forecasts are required to quantify the inherent uncertainty associated with the forecast. However, many existing forecasting methods still only generate point forecasts. Although methods exist to generate probabilistic forecasts from these point forecasts, these are often limited to prediction intervals or must be trained together with a specific point forecast. Therefore, the present article proposes a novel approach for generating probabilistic forecasts from arbitrary point forecasts. In order to implement this approach, we apply a conditional Invertible Neural Network (cINN) to learn the underlying distribution of the data and then combine the uncertainty from this distribution with an arbitrary point forecast to generate probabilistic forecasts. We evaluate our approach by generating probabilistic forecasts from multiple point forecasts and comparing these forecasts to six probabilistic benchmarks on four data sets. We show that our approach generally outperforms all benchmarks with regard to CRPS and Winkler scores and generates probabilistic forecasts with the narrowest prediction intervals whilst remaining reasonably calibrated. Furthermore, our approach enables simple point forecasting methods to rank highly in the Global Energy Forecasting Competition 2014.

Averaging methods are widely used for the control-oriented modeling of systems where high-frequency actuation is used to steer the average of the control variables, such as switching power converters or mechanical systems with vibrational control. Higher-order averaging provides approximations for the trajectories with improved accuracy compared to the commonly used first-order averaging method. Furthermore, differential flatness is a property of dynamical systems which allows parametrizing state and input trajectories from a flat output without integration. In this contribution we investigate the relation between higher-order averaging and flatness via examples of electrical and mechanical systems.

Abstract Generated synthetic time series aim to be both realistic by mirroring the characteristics of real-world time series and useful by including characteristics that are useful for subsequent applications, such as forecasting and missing value imputation. To generate such realistic and useful time series, we require generation methods capable of controlling the non-stationarity and periodicities of the generated time series. However, existing approaches do not consider such explicit control. Therefore, in the present paper, we present a novel approach to control non-stationarity and periodicities with calendar and statistical information when generating time series. We first define the requirements for methods to generate time series with non-stationarity and periodicities, which we show are not fulfilled by existing generation methods. Second, we formally describe the novel approach for controlling non-stationarity and periodicities in generated time series. Thirdly, we introduce an exemplary implementation of this approach using a conditional Invertible Neural Network (cINN). We evaluate this cINN empirically in experiments with real-world data sets and compare it to state-of-the-art time series generation methods. Our experiments show that the evaluated cINN can generate time series with controlled periodicities and non-stationarity, and it also generally outperforms the selected benchmarks.

As Electric Vehicle (EV) demand increases, so does the demand for efficient Smart Charging (SC) applications. However, SC is only acceptable if the EV user’s mobility requirements and risk preferences are fulfilled, i.e. their respective EV has enough charge to make their planned journey. To fulfill these requirements and risk preferences, the SC application must consider the predicted parking duration at a given location and the uncertainty associated with this prediction. However, certain regions of uncertainty are more critical than others for user-centric SC applications, and therefore, such uncertainty must be explicitly quantified. Therefore, the present paper presents multiple approaches to customize the uncertainty quantification of parking duration predictions specifically for EV user-centric SC applications. We decompose parking duration prediction errors into a critical component which results in undercharging, and a non-critical component. Furthermore, we derive quantile-based security levels that can minimize the probability of a critical error given a user’s risk preferences. We evaluate our customized uncertainty quantification with four different probabilistic prediction models on an openly available semi-synthetic mobility data set and a data set consisting of real EV trips. We show that our customized uncertainty quantification can regulate critical errors, even in challenging real-world data with high fluctuation and uncertainty.

Rule learning based intrusion detection systems (IDS) regularly collect and process network traffic, and thereafter they apply rule learning algorithms to the data to identify network communication behaviors represented as IF-THEN rules. Detection rules are inferred offline and can be periodically automatically updated online for intrusion detection. In this context, we implement in the present paper various attacks against MQTT in a carefully designed and very realistic experiment environment, instead of a simulation program as commonly seen in previous works, for data generation. Besides, we investigate a Bayesian rule learning based approach as countermeasure, which is able to detect various attack types. A Bayesian network is learned from training data and subsequently translated into a rule set for intrusion detection. The combination of prior knowledge (about the communication protocol and target system) and data help to efficiently learn the Bayesian network. The translation from the Bayesian network to a set of inherently interpretable rules can be regarded as a transformation from implicit knowledge to explicit knowledge. We show that our proposed method can achieve not only good detection performance but also high interpretability.

Power synchronicity and limited line capacities will become critical challenges in future power systems. In order to tackle them, we advance the energy packet grid (EP grid), which is an alternative energy grid paradigm, inspired by selected design principles of the Internet. The EP grid breaks up the grid into self-organizing, decentralized EP cells wherein EP devices exchange energy packets. Power synchronicity is independently solved within EP cells, leading to a higher robustness of the overall EP grid. We focus on the interplay between the energy plane and the communication plane, i.e., how power electronics and the ability to exchange messages enable an EP grid. In this context, we introduce SEPT, an EP transfer protocol that allows two neighboring EP devices to exchange energy packets. SEPT takes care of the interplay between the energy plane and the communication plane, adding a new interdisciplinary perspective to the field.

Abstract This paper presents a novel partially distributed outer approximation algorithm, named PaDOA, for solving a class of structured mixed integer convex programming problems to global optimality. The proposed scheme uses an iterative outer approximation method for coupled mixed integer optimization problems with separable convex objective functions, affine coupling constraints, and compact domain. PaDOA proceeds by alternating between solving large-scale structured mixed-integer linear programming problems and partially decoupled mixed-integer nonlinear programming subproblems that comprise much fewer integer variables. We establish conditions under which PaDOA converges to global minimizers after a finite number of iterations and verify these properties with an application to thermostatically controlled loads and to mixed-integer regression.

An essential part of the energy systems design procedure is simulation, since it serves as a tool for verification of the respective design. It serves the verifying of a stable operation of developed energy systems infrastructure, before it comes to the realization. As energy systems integration becomes an important part in a low carbon energy scenario in the future, the cooperation of experts specialized in various domains crucial to single aspects of the energy system is indispensable. Cosimulation, yet, enables the modelling in the familiar environment of the experts, but requires a detailed coordination of the simulation interfaces between the specific expert models. Hence, standardized interfaces are crucial to the efficient use of expert knowledge in distributed co-simulations. Therefore, in the presented paper a workflow for the co-simulation development of energy systems simulations, which simplifies the coordination procedure significantly by standardizing the interfaces between the models and their simulations, is introduced. The approach is exemplarily applied to the energy system design of a district comprising electricity and heat in order to show its successful performance.

The present paper describes a new parallel time-domain simulation algorithm using a high performance computing environment - Julia - for the analysis of power system dynamics in large networks. The parallel algorithm adapts a parallel-in-space decomposition scheme to a previously sequential algorithm in order to develop a new parallelizable numerical solution of the power system equations. The parallel-in-space decomposition is based on the block bordered diagonal form, which reformulates the network admittance matrix into sub-blocks that can be solved in parallel. For the optimal spatial decomposition of the network, a new extended graph partitioning strategy is developed for load balancing and minimizing the communication between subnetworks. The new parallel simulation algorithm is tested using standard test networks of varying complexity. The simulation results are compared to those obtained from a sequential implementation in order to validate the solution accuracy and to determine the performance improvement in terms of computational speedup. Test simulations are conducted using the ForHLR II supercomputing cluster and show a huge potential in computational speedup with increasing network complexity.

Population-based metaheuristics -such as Evolutionary Algorithms (EAs)- are one of the most popular methods for solving highly complex and large-scale optimization problems. Nevertheless, finding an adequate solution with such approaches often requires computationally intensive fitness function evaluations especially in real-world applications. To speed up the computation, exploiting modern software techniques for parallelizing population-based metaheuristics on a cluster or a cloud is a viable approach. In the present paper, a generic, flexible and scalable framework for hierarchical hybridization of distributed population-based metaheuristics in a cluster environment is introduced. Three lightweight technologies, namely microservices, container virtualization and the publish/subscribe messaging paradigm are used to develop this framework. The combination of these technologies enables easy hybridizations of different parallelization models of population-based metaheuristics, a full decoupling between services providing basic building blocks of the algorithm and a seamless deployment in a scalable runtime environment. For evaluation purposes, the EA GLEAM (General Learning Evolutionary Algorithm and Method) is exemplarily integrated into the framework and successfully deployed in a cluster environment. Scalability and applicability of the framework are explored by hybridizing the Coarse-Grained Model with the Global Model for solving the problem of unit commitment of distributed energy resources utilizing renewable energy generation. The results show that the new proposed framework introduces an excellent performance for scaling up the optimization speed of complex unit commitment optimization problems.

For a given specific machine learning task, very often several machine learning algorithms and their right configurations are tested in a trial-and-error approach, until an adequate solution is found. This wastes human resources for constructing multiple models, requires a data analytics expert and is time-consuming, since a variety of learning algorithms are proposed in literature and the non-expert users do not know which one to use in order to obtain good performance results. Meta learning addresses these problems and supports non-expert users by recommending a promising learning algorithm based on meta features computed from a given dataset. In the present paper, a new generic microservice-based framework for realizing the concept of meta learning in Big Data environments is introduced. This framework makes use of a powerful Big Data software stack, container visualization, modern web technologies and a microservice architecture for a fully manageable and highly scalable solution. In this demonstration and for evaluation purpose, time series model selection is taken into account. The performance and usability of the new framework is evaluated on state-of-the-art machine learning algorithms for time series forecasting: it is shown that the proposed microservice-based meta learning framework introduces an excellent performance in assigning the adequate forecasting model for the chosen time series datasets. Moreover, the recommendation of the most appropriate forecasting model results in a well acceptable low overhead demonstrating that the framework can provide an efficient approach to solve the problem of model selection in context of Big Data.

By combining several existing simulators, co-simulation approaches are designed for efficient simulator development. Especially for energy systems integration simulations involving different physical domains, co-simulation is the required approach. However, co-simulation setup is complex, time-consuming, and additionally, error-prone for large simulations, especially if visualizations are included. Therefore, for an intensive information exchange between simulators, the present paper introduces a new network-based communication concept including the co-simulation setup procedure. The proposed setup concept enables an efficient configuration for the coupling of distributed simulation modules. The evaluation of the implemented concept on an exemplary power grid simulation with integration of power-to-gas and gas-to-power components and power grid visualization shows the ability for efficient handling of a high amount of exchanged simulation data.

Driven by the great advance of machine learning in a wide range of application areas, the need for developing machine learning frameworks effectively as well as easily usable by novices increased dramatically. Furthermore, building machine learning models in the context of big data environments still represents a great challenge. In the present paper, we tackle these challenges by introducing a new generic framework for efficiently facilitating the training, testing, managing, storing, and retrieving of machine learning models in the context of big data. The framework makes use of a powerful big data software stack and a microservice architecture for a fully manageable and highly scalable solution. A highly configurable user interface is introduced giving the user the ability to easily train, test, and manage machine learning models. Moreover, it automatically indexes models and allows flexible exploration of them in the visual interface. The performance of the new framework is evaluated on state-of-the-arts machine learning algorithms: it is shown that storing and retrieving machine learning models as well as a respective acceptable low overhead demonstrate an efficient approach to facilitate machine learning in big data environments.

Modern critical infrastructures such as Smart Grids (SGs) rely heavily on Information and Communication Technology (ICT) systems to monitor and control operations and states within large-scale facilities. The potential offered by SGs includes an effective integration of renewables, a demand-response action and a dynamic pricing system. The increasing use of ICT for the communication infrastructure of modern power systems offers advantages but can give rise to cyber attacks that compromise the security of the SG. To deal efficiently with the security concerns of SGs, a survey of the different attacks that consider the physical as well as the cyber characteristics of modern power grids is required. In the present paper, first the specific differences between SGs with respect to both Information Technology (IT) systems and conventional energy grids are discussed. Thereafter, the specific security requirements of SGs are presented in order to raise awareness of the new security challenges. Finally, a new classification of cyber attacks, based on the architecture of the SG, is proposed and details for each category are provided. The new classification is distinguished by its focus on the cyber-physical security of the SG in particular, which gives a comprehensive overview of the different threats. Thus, this new classification forms the necessary knowledge-basis for the design of respective countermeasures.

In modern production environments, decision support systems for flexible and scalable manufacturing of functional components have become a critical issue for economic success, especially for small and medium enterprises. Knowledge-based modelling of process chains has been effectively applied to the manufacturing of macro-scale products. However, modelling and therefore the process planning of manufacturing for micro scale products with tight tolerances and high accuracy proves to be very challenging. This paper proposes a methodology to support developers work in the field of micro manufacturing technologies. In particular, support for decision making process through workflow technologies as well as an example for managing technological processes based on a capability database is presented. The ontology allows for modelling and storage of technical capabilities, supporting product developers during the initial product design phase as well as the set-up of suitable manufacturing chains by taking into account different views (materials, technologies, tools, equipment) on a production process. This enables a highly flexible production system, allowing for a fast exchange of design variants and implementation of new manufacturing modules and techniques.

This work addresses a well known problem in energy informatics under view-based modelling aspects. Two standards that describe partially different aspects of power grid systems, the IEC Common Information Model (CIM) on the control level and the IEC 61850 standard on the field level, are gaining ever increasing importance in the ICT developments for the future Smart Grid. Therefore, modelling approaches for the interoperability of both standards will be highly appreciated and several first proposals can be found in the literature. In the context of the establishment of a large energy research lab we apply IEC 61850 as well as CIM and integrate both in an ontology-based data management architecture where CIM entities are linked to measurement time series and substation configuration documents that belong to the IEC 61850 domain.

In order to perform complex data processing and co-simulation workflows for research on data driven energy systems, a generic, modular and highly scalable process operation framework is presented in this article. This framework consistently applies web technologies to build up a microservices architecture. It automates the startup, synchronization, and management of scientific data processing and simulation tools (e.g. Python, Matlab, OpenModelica) as part of larger transdisciplinary, multi-domain data processing and co-simulation workflows. It uses container virtualization on the underlying cluster computing environment to control and manage different simulation nodes.Within the framework's processing workflow, software executables can be distributed to different nodes on the cluster, easily access data and communicate with other components via communication adapters and a high-performance messaging channel infrastructure. By integrating Apache NiFi, the framework also provides an easy-to-use web user interface to allow users to model, perform and operate workflows for future energy system solutions. As soon as a complex workflow is set up in the process operation framework, researchers can use the workflow without any setup or configuration on their local workstations and without knowing any details of the underlying infrastructure or software environment.