Using Deep Learning Algorithms for Cyberattack Detection in IEC 61850-Based Power Systems

In this study, a deep learning-based Intrusion Detection System (IDS) is developed for power systems using the IEC 61850 protocol. Existing literature primarily focuses on detecting cyberattacks under steady-state conditions, often ignoring scenarios involving operational faults. This limitation reduces the effectiveness of these approaches in real-world operations. To address this, the study proposes a method that distinguishes between natural faults and cyber-attack-induced faults. A 735 kV power system was modeled in MATLAB/Simulink and communicated real-time with Linux-based Intelligent Electronic Devices (IEDs). It was shown that False Data Injection (FDI) attacks could manipulate protection systems, potentially leading to incorrect power outages. Among deep learning models trained and tested on data from 1,200 simulations, Recurrent Neural Networks (RNNs) outperformed LSTM and GRU models. This study is a significant step toward to developing deep learning-based IDS for practical use in power systems.