Zero-shot GOOSE Anomaly Detection via Multi-gate Mixture-of-Experts with Pre-Trained Large Language Model

Detecting anomalies in smart grids is vital to safeguarding systems from attacks and failures. As critical components in IEC 61850-based substation communication, Generic Object-Oriented Substation Event (GOOSE) messages are particularly vulnerable to replay, insertion, and flooding attacks, which can compromise availability. However, existing anomaly detection methods mainly focus on traditional network flows like TCP/IP, neglecting the semantic information and structured characteristics of GOOSE messages. This limits the ability to exploit rich information and detect potential attack indicators. Moreover, imbalanced datasets and unseen anomaly types pose additional challenges, highlighting the need for robust few-shot and zero-shot learning approaches. To address these challenges, we propose GAMMPT framework for GOOSE anomaly detection. GAMMPT first leverages pre-trained large language models to extract semantic features and then tackles data imbalance by decomposing multi-class detection into binary classification tasks to improve precise anomaly type recognition. Subsequently, it employs an attention-based Multi-gate Mixture-of-Experts (attMMoE) model to enhance few-shot learning through shared experts and improve anomaly detection accuracy. To enhance zero-shot learning, GAMMPT clusters GOOSE messages and incorporates contrastive learning to enhance embedding robustness. Experiment shows that GAMMPT achieves state-of-the-art performance on real-world datasets.