A Tiered Classification Framework for Detecting and Diagnosing Man-in-the-Middle Attacks in Smart Grid Protocols

The increasing reliance on smart grid communication systems has significantly raised the demand for robust cybersecurity measures to defend against advanced threats. This paper proposes a two-tier classification framework to enhance the detection and diagnosis of man-in-the-middle attacks within smart grid communication protocols. Initially, the model detects the presence of an attack and then identifies the specific type of man-in-the-middle attack through subsequent inferences. To achieve this, the “Man-in-the-Middle Attacks Targeting Modbus TCP/IP and MMS Protocols in the Smart Grid” dataset was carefully preprocessed and analyzed to better understand the underlying hidden characteristics. This understanding, coupled with existing works on fault detection and diagnosis, facilitated the engineering of new features from the original dataset. Four classifiers were employed in each tier: Random Forest, XGBoost, LightGBM, and CatBoost. The first tier exhibited exceptional performance, with the CatBoost framework achieving 99.6% accuracy. The second tier also demonstrated strong results, with the same model achieving 99.1% accuracy. Systematic model explainability was conducted using SHapley Additive exPlanations for both tiers and revealed that the highest accuracy was achieved using five features for the first and six for the second. The average inference time was approximately 4.76 milliseconds. The proposed framework is accurate, fast, interpretable, lightweight, and well-optimized for direct implementation in smart grid systems to detect and diagnose man-in-the-middle attacks.