Early Detection of GOOSE Denial of Service (DoS) Attacks in IEC 61850 Substations

Ghada Elbez, Klara Nahrstedt, Veit Hagenmeyer

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

The availability of communication in IEC 61850 substations can be hindered by Denial of Service (DoS) that result from an advanced Generic Object Oriented Substation Event (GOOSE) poisoning attacks. To the best of our knowledge, most of the available approaches in the literature are unable to detect similar attacks and none of them can offer the detection in an early manner. Thus, we develop the Early Detection of Attacks for GOOSE Network Traffic (EDA4GNeT) method that takes into account the specific features of IEC 61850 substations and offers a good trade-off between detection performance and detection time. To validate the efficiency of the novel anomaly detection method against those specific GOOSE poisoning attacks, a comparison with the closest works to ours is conducted in a similar use case representing a T1-1 substation. Results demonstrate the possibility of an early detection approximately 37 time samples ahead and an average detection rate of EDA4GNeT of more than 99 % with a low false positive rate of less than 1 %.

Original languageEnglish (US)
Title of host publication2022 IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids, SmartGridComm 2022
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages367-373
Number of pages7
ISBN (Electronic)9781665432542
DOIs
StatePublished - 2022
Event2022 IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids, SmartGridComm 2022 - Singapore, Singapore
Duration: Oct 25 2022Oct 28 2022

Publication series

Name2022 IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids, SmartGridComm 2022

Conference

Conference2022 IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids, SmartGridComm 2022
Country/TerritorySingapore
CitySingapore
Period10/25/2210/28/22

Keywords

  • Cyber-physical security
  • Denial of Service (DoS) attacks
  • IEC 61850
  • Intelligent Electronic Devices (IEDs)
  • Intrusion Detection System (IDS)
  • electrical substations

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Artificial Intelligence
  • Computer Science Applications
  • Control and Systems Engineering
  • Safety, Risk, Reliability and Quality
  • Control and Optimization

Fingerprint

Dive into the research topics of 'Early Detection of GOOSE Denial of Service (DoS) Attacks in IEC 61850 Substations'. Together they form a unique fingerprint.

Cite this