TY - GEN
T1 - Early Detection of GOOSE Denial of Service (DoS) Attacks in IEC 61850 Substations
AU - Elbez, Ghada
AU - Nahrstedt, Klara
AU - Hagenmeyer, Veit
N1 - Publisher Copyright:
© 2022 IEEE.
PY - 2022
Y1 - 2022
N2 - The availability of communication in IEC 61850 substations can be hindered by Denial of Service (DoS) that result from an advanced Generic Object Oriented Substation Event (GOOSE) poisoning attacks. To the best of our knowledge, most of the available approaches in the literature are unable to detect similar attacks and none of them can offer the detection in an early manner. Thus, we develop the Early Detection of Attacks for GOOSE Network Traffic (EDA4GNeT) method that takes into account the specific features of IEC 61850 substations and offers a good trade-off between detection performance and detection time. To validate the efficiency of the novel anomaly detection method against those specific GOOSE poisoning attacks, a comparison with the closest works to ours is conducted in a similar use case representing a T1-1 substation. Results demonstrate the possibility of an early detection approximately 37 time samples ahead and an average detection rate of EDA4GNeT of more than 99 % with a low false positive rate of less than 1 %.
AB - The availability of communication in IEC 61850 substations can be hindered by Denial of Service (DoS) that result from an advanced Generic Object Oriented Substation Event (GOOSE) poisoning attacks. To the best of our knowledge, most of the available approaches in the literature are unable to detect similar attacks and none of them can offer the detection in an early manner. Thus, we develop the Early Detection of Attacks for GOOSE Network Traffic (EDA4GNeT) method that takes into account the specific features of IEC 61850 substations and offers a good trade-off between detection performance and detection time. To validate the efficiency of the novel anomaly detection method against those specific GOOSE poisoning attacks, a comparison with the closest works to ours is conducted in a similar use case representing a T1-1 substation. Results demonstrate the possibility of an early detection approximately 37 time samples ahead and an average detection rate of EDA4GNeT of more than 99 % with a low false positive rate of less than 1 %.
KW - Cyber-physical security
KW - Denial of Service (DoS) attacks
KW - IEC 61850
KW - Intelligent Electronic Devices (IEDs)
KW - Intrusion Detection System (IDS)
KW - electrical substations
UR - http://www.scopus.com/inward/record.url?scp=85144178620&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85144178620&partnerID=8YFLogxK
U2 - 10.1109/SmartGridComm52983.2022.9961042
DO - 10.1109/SmartGridComm52983.2022.9961042
M3 - Conference contribution
AN - SCOPUS:85144178620
T3 - 2022 IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids, SmartGridComm 2022
SP - 367
EP - 373
BT - 2022 IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids, SmartGridComm 2022
PB - Institute of Electrical and Electronics Engineers Inc.
T2 - 2022 IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids, SmartGridComm 2022
Y2 - 25 October 2022 through 28 October 2022
ER -