Abstract This article presents the development of a Generic Object Oriented Substation Event (GOOSE) message traffic prediction system using a Nonlinear Autoregressive Model with Exogenous Input (NARX) input. An Artificial Neural Network was adopted to detect Distributed Denial-of-Service (DDoS) attacks in networks using the IEC-61850 protocol. The system uses the OpenFlow protocol to split the multicast groups of GOOSE messages, in which each transmission is analysed separately. The implemented intelligent system used 62 prediction steps with a percentage relative error of up to 5%. The system was embedded in the ZYBO development platform with the OpenMul controller. The results showed that the percentage relative error of each sample presents a determinant signature for classifying the state of operation of the electrical system, making it possible to identify DDoS attacks in communication networks for electric power substations.

中文翻译：

---

用于检测 IEC 61850 通信网络中的 DDoS 攻击的网络流量预测

摘要 本文介绍了使用具有外源输入 (NARX) 输入的非线性自回归模型开发通用面向对象变电站事件 (GOOSE) 消息流量预测系统。采用人工神经网络来检测使用 IEC-61850 协议的网络中的分布式拒绝服务 (DDoS) 攻击。系统采用OpenFlow协议对GOOSE消息的组播组进行拆分，对每一次传输进行单独分析。实施的智能系统使用了 62 个预测步骤，相对误差百分比高达 5%。该系统通过 OpenMul 控制器嵌入到 ZYBO 开发平台中。结果表明，每个样本的百分比相对误差代表了对电气系统运行状态进行分类的决定性特征，