Intelligent Intrusion Detection Mechanism for Cyber Attacks in Digital Substations

With the advent of communication infrastructure and automation, conventional substations have transformed into digital substations as cyber-physical systems. These substations lack matured and intelligent techniques to ensure cybersecurity, making them vulnerable to cyber-attacks. Several studies have been conducted in the literature on effective Intrusion Detection Systems (IDS) for digital substations based on supervised machine learning techniques. However, there are persistent challenges due to unlabeled datasets, and inaccurate detection with high false alarm rates. This paper proposes an intelligent intrusion detection mechanism (IIDM) with high accuracy to detect anomalies in substation Generix Object-Oriented Substation Event (GOOSE) packets caused by Data Manipulation, Man-in-the-middle attacks (MITM), replay, and Denial of Service (DoS). The IIDM is based on data-driven (statistical and ensemble unsupervised learning techniques) and model-based techniques considering the Single Line Diagram of the substation. The efficiency of the proposed IIDM for forensic analysis is discussed using standard GOOSE data sets. The accuracy of the proposed mechanism is tested in real-time on a substation testbed, demonstrating the capabilities of IIDM to provide suitable real-time intrusion detection for substations with high accuracy.