Abstract:This study addresses critical challenges of cybersecurity in digital substations by proposing an innovative task-oriented dialogue (ToD) system for anomaly detection (AD) in multicast messages, specifically, generic object oriented substation event (GOOSE) and sampled value (SV) datasets. Leveraging generative artificial intelligence (GenAI) technology, the proposed framework demonstrates superior error reduction, scalability, and adaptability compared with traditional human-in-the-loop (HITL) processes. Notably, this methodology offers significant advantages over machine learning (ML) techniques in terms of efficiency and implementation speed when confronting novel and/or unknown cyber threats, while also maintaining model complexity and precision. The research employs advanced performance metrics to conduct a comparative assessment between the proposed AD and HITL-based AD frameworks, utilizing a hardware-in-the-loop (HIL) testbed for generating and extracting features of IEC61850 communication messages. This approach presents a promising solution for enhancing the reliability of power system operations in the face of evolving cybersecurity challenges.
What problem does this paper attempt to address?
The problem that this paper attempts to solve is the network security challenges in digital substations, especially the abnormal detection problems in GOOSE (Generic Object Oriented Substation Event) and SV (Sampled Value) datasets. Specifically, the paper proposes a task - oriented dialogue (ToD) system based on generative artificial intelligence (GenAI) to improve the efficiency, scalability and adaptability of abnormal detection in multicast messages.
### Main problems
1. **Limitations of existing methods**:
- **Machine learning (ML) techniques**: Although they have certain potential in detecting abnormalities in GOOSE and SV multicast messages, they have limitations in scalability, decision - making efficiency and data processing.
- **Human - in - the - loop (HITL) process**: It depends on continuous human intervention, resulting in a long processing cycle and difficulty in dealing with new or unknown network threats.
2. **Emerging security threats**:
- The integration of digital substations and communication networks has introduced a variety of security vulnerabilities, and a powerful abnormal detection system is required to protect critical national assets.
- When facing new attack vectors, existing methods need to retrain models frequently, resulting in a waste of time and resources.
### Proposed solution
The paper proposes a task - oriented dialogue system (ToD) based on generative artificial intelligence to solve the above problems in the following ways:
- **Automated decision - making**: Automatically imitate patterns using historical human suggestions to reduce errors and improve decision - making efficiency.
- **Dynamic adaptability**: It has the ability to understand the complexity and nuances of situations and can detect new - type attacks without pre - training.
- **High efficiency**: Compared with traditional ML algorithms and HITL processes, this method has significant advantages in efficiency and implementation speed.
- **Performance evaluation**: Advanced performance indicators are used to compare and evaluate the proposed AD framework and the HITL - based AD framework, and a hardware - in - the - loop (HIL) test platform is used to generate and extract the features of IEC61850 communication messages.
### Conclusion
This research aims to enhance the security and operational stability of smart grid infrastructure by introducing a task - oriented dialogue system based on generative artificial intelligence, especially to provide a more reliable and efficient abnormal detection method in the face of evolving network security challenges.
### Formula representation
The formulas involved in the paper are mainly used to describe the characteristics and rules of GOOSE and SV messages, for example:
- GOOSE message characteristics:
\[
G=(time, DM, SM, type, appid, dataset, goid, stnum, sqnum, data1/data2)
\]
- Rule example:
\[
GR#1(G_i, G_{i - 1})=\begin{cases}
1 & \text{if } DM_i = DM_{i - 1}\land SM_i = SM_{i - 1}\land sqnum_i = sqnum_{i - 1}+ 1\\
0 & \text{otherwise}
\end{cases}
\]
These formulas ensure the accurate description of message characteristics and rules, which helps readers understand the operation mechanism of the system.