A Power Near‐Field Communication Protocol Anomaly Detection Method Based on Formal Comparison of Interaction Behaviors

The Power Near‐Field Communication Network (PNFN) is based on power transmission and communication technologies. In this network, the Power Near‐Field Communication Protocol (PNFCP) regulates and manages device communication. However, the increasing variety and complexity of these protocols pose significant challenges for security detection in PNFN systems. This paper proposes a novel anomaly detection method for power near‐field communication protocols, based on formal comparison of protocol interaction behaviors. Key information from the protocol specification is used to extract the protocol state diagram and construct standardized state path sequences. Actual interaction paths are compared to these sequences, with discrepancies triggering an alarm. Reinforcement learning optimizes the difference scoring and alarm thresholds, improving detection accuracy. This paper applies the proposed method to perform security testing on 20 types of attacks targeting the entity programs of the IEC61850, LoRa, WAPI, and HPLC protocols. The false positive rate was 6.25%, and the false negative rate was 17.5%. With the introduction of reinforcement learning, the false positive rate decreased by 5%, the false negative rate decreased by 11%, and overall performance improved by 9.375%, significantly enhancing the effectiveness of the detection system. © 2025 Institute of Electrical Engineers of Japan and Wiley Periodicals LLC.