Introduction to GOOSE Data Communication Attack Traffic Pattern in IEC 61850

The use of lEC 61850 in electrical substation automation systems may have an impact on increasing the effectiveness and interoperability of smart grids. On the other hand, the development of connectivity will give rise to a high level of security vulnerabilities. Therefore, it is necessary to implement an effective system to protect the integrity of the infrastructure from attacks. This article will present the introduction of normal traffic patterns and attacks by means of feature extraction to improve system performance, as well as a threat detection system from an attack. Through traffic pattern analysis, the system can differentiate between attack traffic and normal traffic. This research describes what normal and attack traffic looks like on GOOSE communication data in the lEC 61850 network. The aim of this research is to identify, explain, and differentiate between normal and attack traffic which finally can increase attack detection, high response capability, and reduce false positives. In the future, it is hoped that the resulting data can reduce data complexity and traffic fluctuations in IEC 61850.