Unsupervised Online Anomaly Detection to Identify Cyber-Attacks on Internet Connected Photovoltaic System Inverters

Often machine learning applications rely on batch learning for training, but a complete set of network communications data may not be readily available. Therefore, this work evaluates the potential for an online learning and detection method that uses an Adaptive Resonance Theory (ART) artificial neural network to protect internet connected photovoltaic (PV) inverters. The methodology involves an initial anomaly detection step to see if the ART algorithm recognizes the behavior. If not, the distance between the nearest ART template (or memory category) is computed and compared with a user defined threshold. Distances that exceed the threshold are flagged while smaller distances designate the data as normal and thus included in the neural network training. It is evident, through experimental tests, that the proposed approach recognizes normal activity and appropriately identifies adversary reconnaissance and denial-of-service actions.