[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-123900-en":3,"doc-seo-123900-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":4,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},123900,137441390410,"Hazel","https://ap-avatar.wpscdn.com/avatar/2000252f4ab5702993?_k=1776741390130283984",8,"Research & Report","ANOMALY DETECTION OF EMS HARDWIRED INFRASTRUCTURE USING SUPERVISED AND UNSUPERVISED ARTIFICIAL INTELLIGENCE MACHINE LEARNING","Anomaly detection methods are developed for protecting EMS-linked microgrid communications against cyber attacks. The Marine Corps Air Station (MCAS) Miramar microgrid began operation in 2021 and integrates 5G non-standalone connectivity between distributed energy resources and the energy management system (EMS). The research builds traffic classification models using an unsupervised machine learning autoencoder trained on benign datasets from an AT&T 5G cellular tower and benign Raytheon hardwired Modbus network traffic. Synthetic anomalies are generated for each dataset to evaluate packet classification. Performance is assessed using F-score, accuracy, precision, and recall through Python and TensorFlow experiments, demonstrating effective training and testing on carefully crafted anomaly sets. The results support establishing a baseline for autoencoder-based intrusion detection in microgrids.","Calhoun: The NPS Institutional Archive  \nDSpace Repository  \n\n| 2024-06\u003Cbr>ANOMALY DETECTION OF EMS HARDWIRED INFRASTRUCTURE USING SUPERVISED AND UNSUPERVISED ARTIFICIAL INTELLIGENCE MACHINE LEARNING\u003Cbr>Ries, Jeffrey S.\u003Cbr>Monterey, CA; Naval Postgraduate School |\n| --- |\n| [https://hdl.handle.net/10945/73215](https://hdl.handle.net/10945/73215) |\n\nNPS Scholarship Theses  \nThis publication is a work of the U.S. Government as defined in Title 17, United States Code, Section 101. Copyright protection is not available for this work in the United States.  \nDownloaded from NPS Archive: Calhoun  \nNAVAL POSTGRADUATE  \nSCHOOL MONTEREY, CALIFORNIA  \nTHESIS  \nANOMALY DETECTION OF EMS HARDWIRED INFRASTRUCTURE USING SUPERVISED AND UNSUPERVISED ARTIFICIAL INTELLIGENCE MACHINE LEARNING  \nby  \nJeffrey S. Ries  \nJune 2024  \nThesis Advisor: Preetha Thulasiraman  \nSecond Reader: Darren J. Rogers  \nDistribution Statement A. Approved for public release: Distribution is unlimited.  \nTHIS PAGE INTENTIONALLY LEFT BLANK  \n\n| REPORT DOCUMENTATION PAGE |  |  |  |  | Form Approved OMB No. 0704-0188 |  |  |\n| --- | --- | --- | --- | --- | --- | --- | --- |\n| Public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instruction, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden, to Washington headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302, and to the Office of Management and Budget, Paperwork Reduction Project (0704-0188) Washington, DC, 20503. |  |  |  |  |  |  |  |\n| 1. AGENCY USE ONLY (Leave blank) |  | 2. REPORT DATE\u003Cbr>June 2024 |  | 3. REPORT TYPE AND DATES COVERED\u003Cbr>Master’s thesis |  |  |  |\n| 4. TITLE AND SUBTITLE\u003Cbr>ANOMALY DETECTION OF EMS HARDWIRED INFRASTRUCTURE USING SUPERVISED AND UNSUPERVISED ARTIFICIAL INTELLIGENCE MACHINE LEARNING |  |  |  |  |  | 5. FUNDING NUMBERS\u003Cbr>RMQ80 |  |\n| 6. AUTHOR(S) Jeffrey S. Ries |  |  |  |  |  |  |  |\n| 7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES)\u003Cbr>Naval Postgraduate School\u003Cbr>Monterey, CA 93943-5000 |  |  |  |  |  | 8. PERFORMING\u003Cbr>ORGANIZATION REPORT NUMBER |  |\n| 9. SPONSORING / MONITORING AGENCY NAME(S) AND\u003Cbr>ADDRESS(ES)\u003Cbr>ONR, Arlington, VA 22217 |  |  |  |  |  | 10. SPONSORING / MONITORING AGENCY REPORT NUMBER |  |\n| 11. SUPPLEMENTARY NOTES The views expressed in this thesis are those of the author and do not reflect the official policy or position of the Department of Defense or the U.S. Government. |  |  |  |  |  |  |  |\n| 12a. DISTRIBUTION / AVAILABILITY STATEMENT\u003Cbr>Distribution Statement A. Approved for public\u003Cbr>release: Distribution is unlimited. |  |  |  |  |  | 12b. DISTRIBUTION CODE\u003Cbr>A |  |\n| 13. ABSTRACT (maximum 200 words)\u003Cbr>The microgrid currently deployed at Marine Corps Air Station (MCAS) Miramar, California began operations in 2021. It is unique in its efforts to leverage a Verizon, fifth generation technology (5G), non-standalone communications network to provide connectivity between distributed energy resources and the MCAS energy management system (EMS). With this new technology comes additional risks in the form of cyber attacks. Therefore, novel approaches to combat this threat are necessary to protect vital energy assets. In this thesis, we discuss the development of anomalous traffic detection models that use an unsupervised machine learning autoencoder trained on benign data sets captured from an AT&T 5G cellular tower at the Naval Postgraduate School Sea Land Air Military Research facility and Raytheon hardwired Modbus network at the EMS. We created synthetic anomalies for each data set to test our autoencoder and assess its effectiveness at classifying these pa","cbCaih3kYOPLuPNM","https://ap.wps.com/l/cbCaih3kYOPLuPNM","pdf",3973961,1,93,"English","en",105,"# Abstract\n# Problem Context: MCAS Miramar Microgrid and EMS-Linked Connectivity\n## Cyber Risk from 5G Non-Standalone Communications\n# Methodology: Data Sources and Model Development\n## Unsupervised Autoencoder Trained on Benign Traffic\n## Synthetic Anomalies for Evaluation\n# Experimental Setup and Metrics\n## Python and TensorFlow Experiments\n## Performance Metrics (F-score, Accuracy, Precision, Recall)\n# Results and Implications for Intrusion Detection in Microgrids","[{\"question\":\"What microgrid and communication setup motivates the anomaly detection research?\",\"answer\":\"The work targets the MCAS Miramar microgrid, which uses 5G non-standalone communications to connect distributed energy resources with the EMS.\"},{\"question\":\"How are benign and anomaly data used to train and evaluate the models?\",\"answer\":\"Benign datasets are collected from an AT\\u0026T 5G cellular tower and Raytheon hardwired Modbus network, and synthetic anomalies are created for each dataset to test classification performance.\"},{\"question\":\"Which metrics and tools are used to assess detection effectiveness?\",\"answer\":\"Experiments use Python and TensorFlow, evaluating results with F-score, accuracy, precision, and recall.\"}]","ANOMALY DETECTION OF EMS HARDWIRED INFRASTRUCTURE USING SUPERVISED AND UNSUPERVISED ARTIFICIAL INTELLIGENCE MACHINE LEARNING | PDF",1785819145,234,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"anomaly-detection-of-ems-hardwired-infrastructure-using-supervised-and-unsupervised-artificial-intelligence-machine-learning","",{"@graph":36,"@context":85},[37,54,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/anomaly-detection-of-ems-hardwired-infrastructure-using-supervised-and-unsupervised-artificial-intelligence-machine-learning/123900/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":62,"encodingFormat":61,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-04",true,{"@type":65,"interactionType":66,"userInteractionCount":4},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What microgrid and communication setup motivates the anomaly detection research?","Question",{"text":75,"@type":76},"The work targets the MCAS Miramar microgrid, which uses 5G non-standalone communications to connect distributed energy resources with the EMS.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How are benign and anomaly data used to train and evaluate the models?",{"text":80,"@type":76},"Benign datasets are collected from an AT&T 5G cellular tower and Raytheon hardwired Modbus network, and synthetic anomalies are created for each dataset to test classification performance.",{"name":82,"@type":73,"acceptedAnswer":83},"Which metrics and tools are used to assess detection effectiveness?",{"text":84,"@type":76},"Experiments use Python and TensorFlow, evaluating results with F-score, accuracy, precision, and recall.","https://schema.org",{"og:url":52,"og:type":87,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":89,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":46,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]