Machine-Learning-Based Anomaly Detection for GOOSE in Digital Substations

Digital substations have adopted a high amount of information and communication technology (ICT) and cyber–physical systems (CPSs) for monitoring and control. As a result, cyber attacks on substations have been increasing and have become a major concern. An intrusion-detection system (IDS) could be...

Full description

Saved in:
Bibliographic Details
Published in:Energies (Basel) 2024-08, Vol.17 (15), p.3745
Main Authors: Nhung-Nguyen, Hong, Girdhar, Mansi, Kim, Yong-Hwa, Hong, Junho
Format: Article
Language:English
Subjects:
Algorithms
Analysis
Automation
Communication
Cybersecurity
Cyberterrorism
Data encryption
deep neural networks
Detectors
Digital signatures
Electricity distribution
fault line location identification
Infrastructure
Internet
Investment analysis
Machine learning
Neural networks
Poisoning
power systems fault classification
Protocol
R&D
Research & development
Safety and security measures
Statistical analysis
Citations: Items that this one cites
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Digital substations have adopted a high amount of information and communication technology (ICT) and cyber–physical systems (CPSs) for monitoring and control. As a result, cyber attacks on substations have been increasing and have become a major concern. An intrusion-detection system (IDS) could be a solution to detect and identify the abnormal behaviors of hackers. In this paper, a Deep Neural Network (DNN)-based IDS is proposed to detect malicious generic object-oriented substation event (GOOSE) communication over the process and station bus network, followed by the multiclassification of the cyber attacks. For training, both the abnormal and the normal substation networks are monitored, captured, and logged, and then the proposed algorithm is applied for distinguishing normal events from abnormal ones within the network communication packets. The designed system is implemented and tested with a real-time IEC 61850 GOOSE message dataset using two different approaches. The experimental results show that the proposed system can successfully detect intrusions with an accuracy of 98%. In addition, a comparison is performed in which the proposed IDS outperforms the support vector machine (SVM)-based IDS.
ISSN:1996-1073
1996-1073
DOI:10.3390/en17153745