Research on Power Terminal Attack Detection Technology Based on ATT&CK Multi-modal Perception

Wang et al. [131] used a data lake and microservices architecture (MSA) to implement a distributed system capable of real-time analysis of large-scale heterogeneous logs.

“A data lake and microservices architecture (MSA) are used to implement a distributed system capable of real-time analysis of large-scale heterogeneous logs.”

Wang et al. [131] proposed a multimodal anomaly detection method that integrates heterogeneous data sources to precisely detect security threats at power Distribution Terminal Units (DTUs).

“Wang et al. [131] proposed a multimodal anomaly detection method that integrates heterogeneous data sources to precisely detect security threats at power Distribution Terminal Units (DTUs).”

In a realistic power grid test environment, Wang et al. [131]'s multimodal detector achieved approximately 90% detection accuracy with an average detection delay of 2-4 min, significantly improving attack identification and phase prediction compared with single-source IDS solutions.

“In a realistic power grid test environment, the multimodal detector achieved approximately 90% detection accuracy with an average detection delay of 2-4 min, significantly improving attack identification and phase prediction compared with single-source IDS solutions.”

Wang et al. [131]'s detection framework defines stage-wise detection points based on the MITRE ATT&CK threat model and adopts both feature-level and decision-level fusion to learn cross-domain correlations.

“The detection framework defines stage-wise detection points based on the MITRE ATT&CK threat model and adopts both feature-level and decision-level fusion to learn cross-domain correlations.”

Wang et al. [131] used real operational logs and a Simulated Power Terminal Dataset to construct hybrid cyber-physical data including network traffic, system and application logs, asset information, control commands, and sensor measurements.

“Using real operational logs and a Simulated Power Terminal Dataset, they construct hybrid cyber-physical data including network traffic, system and application logs, asset information, control commands, and sensor measurements.”

Some hybrid data fusion works couple fused anomaly scores with higher-level decision modules-such as attack-stage modeling, ATT&CK-based threat mapping, or reinforcement learning-based model selection-so that hybrid data directly drives mitigation policies and adaptive defense strategies in real time.

“Third, some works couple fused anomaly scores with higher-level decision modules-such as attack-stage modeling, ATT&CK-based threat mapping, or reinforcement learning-based model selection-so that hybrid data directly drives mitigation policies and adaptive defense strategies in real time [128,131,132].”

Several hybrid data fusion frameworks are designed to operate across multiple datasets and domains by providing generic pipelines for heterogeneous feature processing and multi-modal fusion, rather than redesigning ad hoc detectors for each individual system.

“Second, several frameworks are designed to operate across multiple datasets and domains by providing generic pipelines for heterogeneous feature processing and multi-modal fusion, rather than redesigning ad hoc detectors for each individual system [124,129,131].”