  The smart grid concept has transformed the traditional power grid into a
massive cyber-physical system that depends on advanced two-way communication
infrastructure to integrate a myriad of different smart devices. While the
introduction of the cyber component has made the grid much more flexible and
efficient with so many smart devices, it also broadened the attack surface of
the power grid. Particularly, compromised devices pose a great danger to the
healthy operations of the smart-grid. For instance, the attackers can control
the devices to change the behaviour of the grid and can impact the
measurements. In this paper, to detect such misbehaving malicious smart grid
devices, we propose a machine learning and convolution-based classification
framework. Our framework specifically utilizes system and library call lists at
the kernel level of the operating system on both resource-limited and
resource-rich smart grid devices such as RTUs, PLCs, PMUs, and IEDs. Focusing
on the types and other valuable features extracted from the system calls, the
framework can successfully identify malicious smart-grid devices. In order to
test the efficacy of the proposed framework, we built a representative testbed
conforming to the IEC-61850 protocol suite and evaluated its performance with
different system calls. The proposed framework in different evaluation
scenarios yields very high accuracy (avg. 91%) which reveals that the framework
is effective to overcome compromised smart grid devices problem.
