Measurement Automation Terminal Attack Simulation and Machine Learning-based Anomaly Detection Methods

Aiming at attack behaviors such as data tampering and command injection faced by measurement automation terminals in the power grid, this paper proposes an anomaly detection method that integrates attack simulation and improved machine learning algorithms. The effectiveness of the attack detection method is validated by constructing a closed-loop experimental workflow comprising attack injection, multi-feature extraction, and cascaded detection model response. Firstly, the attack surfaces of measurement automation terminals communication protocols at the physical and application layers are analyzed, and attack scenarios are designed accordingly. Secondly, the random subspace isolation characteristics of isolated forest are used to quickly locate outliers, extract multi-dimensional core features, and adaptively segment the feature space through the gradient lifting decision tree, so as to optimize the boundary division of multi category attacks and solve the problem of misjudgment. Finally, the model's attack detection efficacy was evaluated using appropriate performance metrics, confirming its engineering utility in safeguarding measurement automation terminals. This provides a lightweight solution for anomaly detection in terminal devices.