Adaptive Learning Feature Quantization for In-network FDI Detection in IEC 61850 Digital Substations

eBPF is getting traction as an offload technology for supporting low-latency networking and security function acceleration, with excellent integration in end-host networking stacks. eBPF offloads the network stack to in–kernel and in–network programs offering fast execution times for tasks such as real–time network monitoring, network traffic manipulation and system profiling. At the same time, in order to bound execution time, it provides a constrained environment with, among others, no support for Floating Point (FP) arithmetic, something that can hinder the development of advanced traffic classification algorithms required for cybersecurity and anomaly detection use-cases. In this work, we use a feature–aware KL–divergence–based quantization methodology to implement a False Data Injection (FDI) detection micro–service over BPFabric, an eBPF–based programmable network dataplane framework, using feature–aware quantization on GOOSE traffic in an IEC 61850 digital substation. When compared to Standard Scaling (SS), FP arithmetic, and conventional quantization methods, the proposed adaptive quantization improves detection accuracy, F1–score, and receiver–operating–characteristics (ROC) by 5.49%, 8.3%, and 7.05%, respectively. In addition, it improves resource utilization by up to 46% and 10% in inference model size compared to conventional SS and quantization methods, respectively. Inference time is also improved by 10<sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">−5</sup>s compared to a userspace implementation.