A new methodology for anomaly detection of attacks in IEC 61850-based substation system

Smart substation is a crucial Cyber-Physical system and is prone to cyber-attack. In this paper, we propose a novel anomaly detection mechanism tailored for detecting the IEC 61850-based network traffic. Three types of traffic features are taken into account for comprehensively characterizing the network traffic during a time window. To eliminate the subjectivity of manually selecting the traffic features, we exploit Discrete Wavelet Transform (DWT) algorithm to secondarily extract the deep features. An improved Locally Linear Embedding (LLE) algorithm is proposed to reduce the dimension of deep feature vectors with more effective dimensionality reduction ability. By doing so, the LSTM (Long Short Term Memory)-based Autoencoder network that can learn to reconstruct the normal traffic time-series behavior, and thereafter uses the reconstruction error to detect the anomalies. We assess the performance of our proposed mechanism with the comprehensive experiments on the real smart substation. The results indicate that the proposed mechanism can be performed in a fast way with satisfactory detection performance.