Research on intrusion detection of IEC 61850 protocol based on feature selection and triadic concept analysis

Abstract Cybersecurity incidents targeting the power grid have been increasing in recent years. The IEC 61850 protocol serves as a safeguard for substation communications, and its security plays an important role in the safe and stable operation of the power grid. Aiming at the problem of low accuracy of intrusion detection of IEC 61850 communication protocols, this paper proposes ATCV model by combining feature selection and triadic concept analysis. The ATCV model includes three parts: data preprocessing, feature selection, and FL (Fuzzy Triadic Concept Analysis) classification model construction. Firstly, due to the different forms of datasets, the training set and test set are preprocessed separately, and for the test set the data grammar library is used to standardize it; Then, redundant features are eliminated based on feature contribution to generate a streamlined dataset; Finally, fuzzy triadic backgrounds are generated based on the streamlined dataset, fuzzy triadic concepts are constructed and transformed into feature triadic concept vectors. Construct a vector group based on the representation vectors and set the initial weight values, then dynamically adjust the weight values through the vector group to the classification results of the test data to generate the FL classification model. In order to test the classification effect of the ATCV model, the model was validated through horizontal and longitudinal comparison experiments. Experiments show that the accuracy, precision, recall and F1-Score of the ATCV model reach 93.92, 93.26, 99.96 and 96.5% respectively, which are significantly better than those of the SVM, KNN, CNN, DPL-FSAD and FSL-SCNN models; And the more the amount of data, the better the detection effect of ATCV.