Increased connectivity is required to implement novel coordination and control schemes. IEC 61850-based communication solutions have become popular due to many reasons—object-oriented modeling capability, interoperable connectivity and strong communication protocols, to name a few. However, communication infrastructure is not well-equipped with cybersecurity mechanisms for secure operation. Unlike online banking systems that have been running such security systems for decades, smart grid cybersecurity is an emerging field. To achieve security at all levels, operational technology-based security is also needed. To address this need, this paper develops an intrusion detection system for smart grids utilizing IEC 61850’s Generic Object-Oriented Substation Event (GOOSE) messages. The system is developed with machine learning and is able to monitor the communication traffic of a given power system and distinguish normal events from abnormal ones, i.e., attacks. The designed system is implemented and tested with a realistic IEC 61850 GOOSE message dataset under symmetric and asymmetric fault conditions in the power system. The results show that the proposed system can successfully distinguish normal power system events from cyberattacks with high accuracy. This ensures that smart grids have intrusion detection in addition to cybersecurity features attached to exchanged messages.

中文翻译：

---

基于机器学习的入侵检测，使用IEC 61850 GOOSE消息实现智能电网中的网络安全

为了实现新颖的协调和控制方案，需要增加连接性。基于IEC 61850的通信解决方案由于许多原因而变得流行，例如面向对象的建模功能，可互操作的连接性和强大的通信协议。但是，通信基础设施尚不足以提供用于安全操作的网络安全机制。与运行此类安全系统数十年的在线银行系统不同，智能电网网络安全是一个新兴领域。为了实现所有级别的安全性，还需要基于操作技术的安全性。为了满足这一需求，本文利用IEC 61850的通用面向对象变电站事件（GOOSE）消息开发了一种用于智能电网的入侵检测系统。该系统是通过机器学习开发的，能够监视给定电力系统的通信流量，并将正常事件与异常事件（即攻击）区分开。在电力系统中的对称和非对称故障条件下，使用实际的IEC 61850 GOOSE消息数据集来实施和测试设计的系统。结果表明，所提出的系统能够以较高的准确度成功地将正常的电力系统事件与网络攻击区分开。这确保了智能电网除了附加到交换消息的网络安全功能之外，还具有入侵检测功能。在电力系统中的对称和非对称故障条件下，使用实际的IEC 61850 GOOSE消息数据集来实施和测试设计的系统。结果表明，所提出的系统能够以较高的准确度成功地将正常的电力系统事件与网络攻击区分开。这确保了智能电网除了附加到交换消息的网络安全功能之外，还具有入侵检测功能。在电力系统中的对称和非对称故障条件下，使用实际的IEC 61850 GOOSE消息数据集来实施和测试设计的系统。结果表明，所提出的系统能够以较高的准确度成功地将正常的电力系统事件与网络攻击区分开。这确保了智能电网除了附加到交换消息的网络安全功能之外，还具有入侵检测功能。