TranRAT: a lightweight anomaly detection model based on unsupervised learning for insider stealthy attacks in SAS

Abstract Due to the frequent sourcing of Intelligent Electronic Devices (IEDs) from third-party sources, they are highly susceptible to targeted attacks on Substation Automation Systems (SASs). However, most current anomaly detection methods are ineffective against insider stealthy attacks, which simulate benign operations to mask malicious behavior. Furthermore, the lack of annotated datasets within current SAS environments hinders the training of various detection methods. Therefore, this paper introduces TranRAT, a lightweight anomaly detection model for insider stealthy attacks in SAS, which employs unsupervised learning and deep Transformer to adapt to scene requirements. TranRAT is designed to detect covert internal attacks initiated by untrusted IEDs within SAS environments. Initially, it identifies and extracts thirteen critical features from Generic Object Oriented Substation Event messages, emphasizing system-wide characteristics over individual device specifics. Subsequently, it applies suitable label expansion strategies to capture temporal correlations and employs attention-based sequence encoders to bolster robust adversarial training. Experimental results demonstrate that TranRAT surpasses baseline methods. Compared to leading models for multivariate time-series data, TranRAT achieves a 15%–60% enhancement in F1 scores on complete and limited training datasets, while reducing training duration by up to 99%.