An interpretable memory forensics framework for unknown attack identification in power grid edge devices

Area of Science:

• Computer Science
• Cybersecurity
• Digital Forensics

Background:

• Power grid edge equipment faces complex security threats due to the adoption of domestic trusted operating systems.
• Existing security measures may not adequately address the unique challenges of power grid environments.

Purpose of the Study:

• To develop a comprehensive framework for power grid edge operating system security.
• To integrate memory forensics with malicious attack type discrimination for enhanced threat detection.

Main Methods:

• A fully encrypted memory mirroring mechanism was designed for legal validity and non-repudiation of forensic data.
• An interpretability model was developed to analyze process behavior and abnormal kernel objects in attacked memory images.
• A gradient lifting algorithm was employed to classify unknown attack types based on memory image characteristics.

Main Results:

• The proposed method achieved 99.9% recognition accuracy for memory subjected to malicious attacks.
• Specific classification accuracy for unknown malicious attacks reached 99.99%.
• Performance significantly surpassed traditional machine learning methods.

Conclusions:

• The developed framework effectively enhances memory forensics and malicious attack identification in power grid systems.
• Automated analysis and classification of memory attacks improve the efficiency of power grid cybersecurity operations.
• The approach provides valuable reference samples for traceability forensics in critical infrastructure protection.