Cyber Risk Detection for IEC 60870-5-104 Operation Commands in Distribution Systems

To address the increasing cybersecurity challenges in distribution automation systems, this paper proposes a modeling method for International Electrotechnical Commission (IE C) 60870-5-104 protocol that integrates network layer traffic features and application layer protocol features. Through improved ARIMA (Auto-Regressive Integrated Moving Average) time series modeling and wavelet packet analysis, precise modeling of communication traffic is achieved. Based on information entropy theory, a protocol field correlation model is constructed, and combined with random forest and improved deep autoencoder to achieve efficient monitoring of remote control command anomalies. Experimental results demonstrate that this method shows significant advantages in both accuracy and real-time performance of anomaly detection.