ML-based Anomaly Detection System for IEC 61850 Communication in Substations
Souradeep Bhattacharya, Nazmus Saqib, Manimaran Govindarasu
Abstract
IEC 61850-based Substation Automation Systems (SAS) plays a crucial role within the modern grid as they are responsible for switching, transforming, monitoring, metering, and ensuring protection. IEC 61850 establishes standardized protocols to facilitate communication between different SAS devices. However, there have been growing concerns related to the cybersecurity of IEC 61850 protocols due to their lack of inherent security features. This has increased its susceptibility to cyber-attacks, which can lead to severe consequences if the attacks remain undetected and unmitigated. This paper proposes a supervised machine learning (ML)-based anomaly detection system (ADS) for detecting various cyber-attacks for IEC 61850-based SAS networks. The proposed ML-ADS is implemented for IEC 61850 protocols, such as GOOSE and Sampled Values, and adopts traffic augmentation and data balancing techniques to train several time-series data-compatible ML-based anomaly detection algorithms. Different IEC 61850-specific open-source datasets with realistic cyber-attacks and network traffic are considered to analyze the performance of the proposed ML-ADS. Our experimental evaluation demonstrates a promising performance with high accuracy and true-positive rates (more than 99%) and low false-negative rates (less than 1%).