Abstract:In recent decades, cyber security issues in IEC 61850-compliant substation automation systems (SASs) have become growing concerns. Many researchers have developed various strategies to detect malicious behaviours of SASs during the system operational stage, such as anomaly-based detection. However, most existing anomaly-based detection methods identify an abnormal behaviour by checking every single network packet without any association. These traditional methods cannot effectively detect “stealthy” attacks which modify legitimate messages slightly while imitating patterns of benign behaviours. In this paper, we present feature selection and extraction methods to generalise and summarise critical features when detecting insider attacks triggering from untrusted control devices within SASs. By applying a sliding window-based sequential classification mechanism, our detection method can detect anomalies across multiple devices without the need to learn datasets collected from all devices. Firstly, to generalise critical features and summarise systems’ behaviours so that it is unnecessary to collect all datasets, we selected and extracted six critical network features from generic object-oriented substation events (GOOSE) messages and seven summarised physical features based on the general architecture of the primary plant of distribution substations. After that, to improve detection accuracy and reduce computational costs, we applied sliding window algorithms to divide datasets into different overlapped window-based snippets. Then we applied a sequential classification model based on Bidirectional Long Short-Term Memory networks to train and test those datasets. As a result, our method can detect insider attacks across multiple devices accurately with a false-negative rate of less than 1%.

Early Attack Detection for Securing GOOSE Network Traffic

A novel hybrid methodology to secure GOOSE messages against cyberattacks in smart grids

A Geometrical Approach to Enhance Security Against Cyber Attacks in Digital Substations

GOOSE Secure: A Comprehensive Dataset for In-Depth Analysis of GOOSE Spoofing Attacks in Digital Substations

Performance Analysis of Routable GOOSE Security Algorithm for Substation Communication through Public Internet Network

Denial-of-Service Attack on IEC 61850-Based Substation Automation System: A Crucial Cyber Threat towards Smart Substation Pathways

PowerDuck: A GOOSE Data Set of Cyberattacks in Substations

SDN-Based Dynamic Cybersecurity Framework of IEC-61850 Communications in Smart Grid

Leveraging Conversational Generative AI for Anomaly Detection in Digital Substations

Evaluation of Time-Critical Communications for IEC 61850-Substation Network Architecture

Spatial-Temporal Data-Driven Model for Load Altering Attack Detection in Smart Power Distribution Networks

Application of IEC 61850 GOOSE Technology on Protective Relaying

Anomaly Detection for Insider Attacks From Untrusted Intelligent Electronic Devices in Substation Automation Systems

Research on Situation Assessment of Active Distribution Networks Considering Cyberattacks

CP Fusion based Abnormal Traffic Dedection for Process Layer Network in Digital Substation

Assessment and Quantify the Impact of Different Data Flow Control Methods on Digital Substation Communication Network

A Novel Generative AI-Based Framework for Anomaly Detection in Multicast Messages in Smart Grid Communications

OPNET Based Simulation Modeling and Analysis of DoS Attack for Digital Substation

Digital Substation Cyber Security Analysis with Syn-Flood Attack As A Simulation Case

GOOSE Network Faults Analysis and Treatment of Data Substation

Intrusion Detection of NSM Based DoS Attacks Using Data Mining in Smart Grid