Detecção de ataques de negação de serviço em inversores fotovoltaicos conectados à internet: uma abordagem por ensemble de aprendizagem de máquina

Abstract

The application of artificial intelligence to detect DoS attack traffic in on-grid photovoltaic system inverters connected to the internet, in a distributed mini-generation configuration (75 kW to 5 MW), describes and delimits the scope of this academic work, in which Machine Learning (ML) techniques are applied to enable such detection. The objective of this research is to propose, implement, and experimentally evaluate an integrated system for detecting DoS attack traffic in photovoltaic inverters connected to the electrical grid. The proposed solution is based on the use of Artificial Intelligence to monitor cybersecurity incidents and prevent security failures in internet-connected inverters. The methodology is based on an ensemble of classifiers (Random Forest and SVM with weighted voting), trained and validated on a proprietary dataset obtained through traffic capture in a simulated experimental environment (OpenEMS in Docker, attacks generated via Scapy), totaling 43,200 instances, stratified partitioned into training (70%), validation (15%), and test (15%). The public UNSW-NB15 dataset was used exclusively as an external reference for calibrating the relative importance of features, not comprising the training, validation, or test partitions. The experimental results demonstrate that the proposed ensemble achieved, on the complete test set, an accuracy of 97.3%, recall of 98.2%, and false positive rate (FPR) of 6.9% in detecting simulated denial-of-service (DoS) attacks. In direct comparison with traditional methods on the same subset of patterns not observed during training, the ensemble achieved an accuracy of 94.1%, surpassing Snort (12.5%) and Zeek (45.2%). The system maintained accuracy above 97% with up to 10% packet loss and recall of 94.1% in evasion attacks (when an attacker attempts to disguise traffic), with an average inference latency of 12.3 ms and CPU overhead of only 23%, confirming real-time operational feasibility. It is concluded that the proposed approach is effective and robust under the tested conditions, derived from synthetic traffic generated in a virtualized environment with deterministic labeling, representing a relevant contribution to the cybersecurity of renewable energy infrastructures and a solid foundation for future validation in real distributed mini-generation systems of similar scale.