Machine-Learning-Based Anomaly Detection for GOOSE in Digital Substations

To enhance the reliability, resiliency and sustainability of a microgrid (MG) in the presence of several distributed energy resources (DERs) and loads, communication systems play a vital role, forming it into a cyber-physical system (CPS). However, integration of information and communication technology (ICT) in the MG architecture exposes MG to potential malicious cyber attacks as well. Similarly, electric vehicles (EVs) also come with a host of many cybersecurity risks. The integration of power, communication and transportation sectors empowers the intruders to exploit the vulnerability and disrupt the operation of multiple sectors. Testbed plays a vital role in the study of the threat landscape and the impact of cyber attacks (such as denial of service (DoS) attacks and false data injection attacks (FDIA)) in such cyber-physical infrastructure. This study would further aid to develop and verify the detection and mitigation schemes against cyber attacks.This work presents a detailed study on the development of real-time (RT) cosimulation testbed for inverter-based MG and RT testbed for EV-charging infrastructure. The MG testbed consists of OP5700 RT simulator to emulate cyber-physical layer through HYPERSIM software; and SEL-3530 Real-Time Automation Controller (RTAC) hardware configured with ACSELERATOR RTAC SEL-5033 software. A human-machine interface (HMI) is further developed in ACSELERATOR Diagram Builder SEL-5035 software for local/remote monitoring and control. Furthermore, communication protocols such as Modbus, sampled measured values (SMVs), generic object-oriented substation event (GOOSE) and distributed network protocol 3 (DNP3) on an Ethernet-based interface were established to link the cyber and physical layers. Furthermore, the testbed for EV-charging infrastructure consists of AC and DC emulators to emulate the respective charging station (AC/DC) and EV. It also constitutes various charging cables supported for different charging protocols such as combined charging system (CCS), GB/T and CHAdeMO. To monitor the message exchanges, charging discovery system (CDS) hardware along with its software is used. Few of the test cases have been presented to demonstrate the ability of these testbeds.

Power system automation and communication standards are spearheading the power system transition towards a smart grid. IEC 61850 is one such standard, which is widely used for substation automation and protection. It enables real-time communication and data exchange between critical substation automation and protection devices within digital substations. However, IEC 61850 is not cyber secure. In this paper, we demonstrate the dangerous implications of not securing IEC 61850 standard. Cyber attacks may exploit the vulnerabilities of the Sampled Values (SV) and Generic Object-Oriented Substation Event (GOOSE) protocols of IEC 61850. The cyber attacks may be realised by injecting spoofed SV and GOOSE data frames into the substation communication network at the bay level. We demonstrate that such cyber attacks may lead to obstruction or tripping of multiple protective relays. Coordinated cyber attacks against the protection system in digital substations may cause generation and line disconnections, triggering cascading failures in the power grid. This may eventually result in a partial or complete blackout. The attack model, impact on system dynamics and cascading failures are veri ed experimentally through a proposed cyber-physical experimental framework that closely resembles real-world conditions within a digital substation, including Intelligent Electronic Devices (IEDs) and protection schemes. It is implemented through Hardware-in-the-Loop (HIL) simulations of commercial relays with a Real-Time Digital Simulator (RTDS).

The fast real-time application message is an object-oriented substation event—GOOSE (Generic Object Oriented Substation Event). It mainly works on the process layers and bay layers of digital substation. GOOSE intelligent substation communication network can realize the key function of the overall intelligent sub- station functions. This paper will make a systematic analysis of GOOSE. At first, it will provide a detailed analy- sis of the transmission mechanism and process of GOOSE message. As certain practical operability lacks the actual application of the multicast filtering method which is applied to GOOSE message based on IEC61850 standard, this paper will summarize three message filtering methods, compare the advantages and disadvantages in topological networks of different kinds in accordance with the instantaneity of GOOSE intelligent substation communication network and draw a conclusion that the independent configuration scheme of GOOSE and SV can adapt to the requirement of times, so as to provide theoretical references for the selection of practical intelli- gent substation communication network in the future.

This paper presents a model designing and simulation realization of arc protection system based on GOOSE (Generic Object Oriented Substation Event) .It is proposed to fully use the logical node GGIO (Generic Input and Output) of IEC61850 in the modeling of intelligent electronic devices. The real-time data (data of arc intensity and loop circuit) are transferred by GOOSE message with time delay less than 4 ms. GOOSE message communications mechanism is introduced. Winpcap development packet is selected and the simulation program is written to transmit and capture the GOOSE messages.

Integration of Information and Communication Technology (ICT) in modern smart grids (SGs) offers many advantages including the use of renewables and an effective way to protect, control and monitor the energy transmission and distribution. To reach an optimal operation of future energy systems, availability, integrity and confidentiality of data should be guaranteed. Research on the cyber-physical security of electrical substations based on IEC 61850 is still at an early stage. In the present work, we first model the network traffic data in electrical substations, then, we present a statistical Anomaly Detection (AD) method to detect Denial of Service (DoS) attacks against the Generic Object Oriented Substation Event (GOOSE) network communication. According to interpretations on the self-similarity and the Long-Range Dependency (LRD) of the data, an Auto-Regressive Fractionally Integrated Moving Average (ARFIMA) model was shown to describe well the GOOSE communication in the substation process network. Based on this ARFIMA-model and in view of cyber-physical security, an effective model-based AD method is developed and analyzed. Two variants of the statistical AD considering statistical hypothesis testing based on the Generalized Likelihood Ratio Test (GLRT) and the cumulative sum (CUSUM) are presented to detect flooding attacks that might affect the availability of the data. Our work presents a novel AD method, with two different variants, tailored to the specific features of the GOOSE traffic in IEC 61850 substations. The statistical AD is capable of detecting anomalies at unknown change times under the realistic assumption of unknown model parameters. The performance of both variants of the AD method is validated and assessed using data collected from a simulation case study. We perform several Monte-Carlo simulations under different noise variances. The detection delay is provided for each detector and it represents the number of discrete time samples after which an anomaly is detected. In fact, our statistical AD method with both variants (CUSUM and GLRT) has around half the false positive rate and a smaller detection delay when compared with two of the closest works found in the literature. Our AD approach based on the GLRT detector has the smallest false positive rate among all considered approaches. Whereas, our AD approach based on the CUSUM test has the lowest false negative rate thus the best detection rate. Depending on the requirements as well as the costs of false alarms or missed anomalies, both variants of our statistical detection method can be used and are further analyzed using composite detection metrics.

Substations are becoming increasingly reliant on international electrotechnical commission (IEC)-61850-enabled devices. However, device compatibility with these standards does not guarantee interoperability when devices are taken from different manufacturers. If interoperability of multivendor devices can be achieved, then power utilities will be in a position to implement multivendor devices in substations. The study here presents the development and testing of a digital substation test platform that incorporates devices from different manufacturers. The process bus communication and protection operation of the intelligent electronic devices (IEDs) were tested to validate device interoperability. The testbed was tested for two IED process bus communications, generic object-oriented substation event (GOOSE) and sampled measured value (SMV). The GOOSE is travelling between IED to IED with an end-to-end (ETE) delay of 2 ms and the SMV read by the IEDs are the same as the injected real-time substation inputs 220 kV and 1 kA. Three IED protection studies (overcurrent, earth fault, and overvoltage) were performed, and IED response curves were obtained. In addition, data monitoring and client–server communications were studied using installed software tools. The testbed configuration in this study has faced some real-time challenges regarding differences in device edition, device firmware, and ethernet switch due to its multivendor approach. All the mentioned configuration issues were resolved in this study with successful testing and validation of the testbed. The study of this testbed will provide solutions to the problems associated with a multivendor system faced by substation engineers and will help them in opting for multivendor installations. This system can be extended in the future by installing more multivendor devices with complex network topology and a SCADA system.

With the rapid expansion of digital networks and the increasing complexity of cyber threats, network security has emerged as a crucial field within information and communications technology (ICT). Modern organizations face growing risks from sophisticated cyber-attacks that threaten the confidentiality, integrity, and availability of critical systems. Intrusion Detection Systems (IDS) have become a foundational tool for identifying and mitigating unauthorized access and suspicious activities within networks. These systems are broadly categorized into Signature-Based Intrusion Detection Systems (SIDS), which rely on known threat patterns, and Anomaly-Based Intrusion Detection Systems (AIDS), which detect deviations from normal behavior to identify unknown attacks. Despite their strengths, both types face significant limitations, including high false-positive rates and challenges in real-time detection. This study explores the evolving landscape of network security threats and critically analyzes existing intrusion detection techniques. It highlights the integration of alert correlation and prediction mechanisms that enhance early detection and response capabilities. Furthermore, the study addresses key limitations and challenges in IDS implementation and identifies emerging trends aimed at improving scalability, intelligence, and adaptability of detection mechanisms. By evaluating current systems and proposing directions for future research, this work contributes to the development of more robust and proactive network defense strategies in an increasingly interconnected digital world.

Extending reliable and dependable communications for protection and control applications beyond the substation fence to additional sites and field devices can sometimes be a challenging task. Uneven terrain, distance, or other factors can make running cable difficult or impossible. In some cases, wireless communication is a cost-effective and practical alternative to pulling cable. Radios have proven to be an effective means of extending communications for supervisory control and data acquisition (SCADA) and engineering access, as well as for critical protection and control applications using serial communications. Low-latency Ethernet protocols like Generic Object-Oriented Substation Event (GOOSE) are becoming popular for high-speed, point-to-multipoint signaling protection and control applications. Radios used in protection and control should be evaluated for the specific application for which they are intended. This paper examines the application of GOOSE over Ethernet radios and the associated challenges. The paper shares results from a real-world implementation, including results from GOOSE latency tests for protection and control applications.

Background. Life expectancy is an important health status indicator based on average number of years a person at a given age may be expected to live given current mortality rates. Given this significance, it would be necessary to probe into the factors affecting the life expectancy. Ensuring that information and communication technology (ICT) services are properly used could contribute to development and achievement, as it represents an important issue for the countries moving toward knowledge-based and information-based societies. Therefore, this study explored the impact of the information and communication technology on life expectancy. Methods. This study covers annual data from 2008 to 2018 for a group of countries in the Middle East. Data were retrieved from the Annual Reports such as World Bank and International Telecommunication Union (ITU) data sets. The effects of ICT on life expectancy are estimated with the Panel model. We also used the Hausman test to investigate fixed versus random effects. The data were analyzed by Stata 14 software. Results. The core findings of this study confirm the significant impact of ICT on life expectancy in the Middle East. The calculated Coefficient of the regression was 0.551 indicating how much life expectancy changes when ICT variable increases by one unit. Moreover, the rho (intraclass correlation) was found to be 0.975 showing that 97.5% of the variance is due to differences across panels. Conclusion. Considering the effect of ICT on life expectancy, policymakers of the Middle Eastern countries should integrate the use of ICT with the existing programs and systems. Technology is not an end in itself but merely the means to reinforce the existing system and to meet the locally determined goals. It can be used as a tool to attain broader health and development goals. Background Life expectancy is an important health status indicator based on average number of years a person at a given age may be expected to live given current mortality rates. Given this significance, it would be necessary to probe into the factors affecting the life expectancy. Ensuring that information and communication technology (ICT) services are properly used could contribute to development and achievement, as it represents an important issue for the countries moving toward knowledge-based and information-based societies. As ICT affects everyday lives, it also impacts the macroeconomic growth, which in turn further affects everyday lives by allowing improvements in infrastructures and a higher standard of living. ICTs inherently entail the economic development of countries, regions and cities, while also improving social inclusion, well-being and therefore quality of life. Therefore, this study explored the impact of the information and communication technology on life expectancy. Methods This study covers annual data from 2008 to 2018 for a group of countries of in the Middle East. Data were retrieved from the Annual Reports such as World Bank dataset and International Telecommunication Union (ITU) data set. The effects of information and communication technology on life expectancy were estimated through the Panel model. First, stationary tests were performed with the Fisher’s generalized unit root test. In the Fisher test for panel data, the null hypothesis of a unit root was rejected at the 5% level of significance. The cross-section correlation test was performed with the Freeze test. The null hypothesis of no correlation was rejected at the 5% level of significance. We also used the Hausman test to investigate fixed versus random effects. The null hypothesis of no fixed effects was accepted so the random effects model was used. The Hausman test detects endogenous regressors in a regression model. Endogenous variables have values that are determined by other variables in the system. The data were analyzed by Stata 14 software. Results The core findings of this study confirm the significant impact of information and communication technology on life expectancy in the Middle East. The Coefficient of the regression was 0.551 indicating how much life expectancy changes when information technology variable increases by one unit. The coefficient of ICT shows that 1% increase in ICT variable causes 0.551 % incline in life expectancy and this result is significant at 5% level of significance. Regarding control variables, we found that all have expected statistically significant effects on life expectancy. The intra-cluster correlation coefficient (rho) is a measure of the relatedness, or similarity, of clustered data. Values of rho range from 0 to 1 in human studies, and as the rho increases, more individuals within the clusters resemble one another. The rho (intraclass correlation) was found to be 0.975 showing that 97.5% of the variance is due to differences across panels. This research recommends that human development programs need to focus on polices which foster digital inclusion. Conclusion Considering the effect of information and communication technology on life expectancy, policymakers of the Middle Eastern countries should integrate the use of information and communication technology with the existing programs and systems. The digital citizen is happier and values living in regions with technological capacity, investing in research & development, and committed to achieving sustainable growth. ICT use leads to improved assessments of the efficiency and management of the public administration by more technological users, underlining the importance of an understanding between users and public services in the virtual sphere. Technology is not an end in itself but merely an instrument to reinforce the existing system and to meet the locally determined goals. It can be used as a tool to attain broader health and development goals. The findings from this study provide key insights that explain how life expectancy may be enhanced through ICTs. Practical Implications of Research According to the influence of information and communication technology (ICT) on life expectancy, policymakers should provide ICT infrastructures and adopt strategies integrating ICT policies with human life criteria such as education, health and work to improve life expectancy. Ethical Consideration The paper reflects the author’s own research and analysis in a truthful and complete manner. Conflict of Interests This study was an independent research and the author declares no potential conflicts of interest with respect to the research, authorship, and/or publication of this article. Acknowledgement I would like to thank Dr Marzieh Ronaghi for her guidance and assistance throughout this research.

The Intrusion Detection System (IDS) is a useful infiltration detection tool. With IDS, it may mechanically categorize intrusions, attacks, or breaches of security stratagems across host-level within the network and within the organization. The Krill Herd Optimized Deep Neural Network (KH-DNN) is proposed in this document as a multiclass cyberattack methodology. This model is suggested by uniting the network-based intrusion detection system (NIDS) and the host-based intrusion detection system (HIDS) to advance flexible and actual IDS to categorize and detect unexpected and unpredictable cyber attacks. In this method, two types of IDS are classified, that is, NIDS and HIDS. Classification of the system call is exploited to discriminate behavior into normal and attack categories. In this manuscript accuracy, the parameter of the deep neural network classifier is optimized with the Krill Herd optimization algorithm. Finally, the DNN model is performed in the NIDS dataset and the HIDS dataset. For the HIDS dataset, the KDD Cup 99 dataset was used, which employed two datasets: ADFA-LD and ADFA-WD, and several types of attacks were detected and classified, including Adduser, Hydra-FTP, Java-Meterpreter, Hydra-SSH, and Web-Shell. The suggested IDS-KH-DNN algorithm attains higher accuracy 42.56% and 23.4%, high precision 84.74% and 52.43%, high F-score 53.5% 64.455, high sensitivity 33.4% and 45.23%, and high specificity 31.45% and 44.23% for the NIDS dataset. The proposed system is compared to two current processes: intrusion detection using Gray Wolf optimization-based support vector machine (IDS-GWO-SVM) and intrusion detection using artificial bee colony optimization algorithm based support vector machine (IDS-ABCO-SVM). Finally, the simulation results show that the suggested approach is capable of quickly and accurately locating optimal solutions.

In this paper, a data-centric communication framework is proposed for multicast routable generic object-oriented substation event (GOOSE) messages (MRGM) over the wide area network (WAN) for effective substation-to-substation (SS2SS) and substation to control center (SS2CC) communications. In this structure, the IEC 61850 GOOSE message is transmitted over the WAN using the data distribution service (DDS) as a fast, reliable, and secure data-centric communication middleware. The main feature of this framework is its multicast capability, where several authorized subscribers can receive a published message simultaneously. This can significantly improve the system monitoring and control of the protection systems in modern smart grids, where intelligent schemes can be applied. The effectiveness of the proposed platform, in terms of total end-to-end delay between participants, is evaluated through experimental results obtained from the actual hardware-based test setup developed at the Florida International University (FIU) smart grid testbed. The results demonstrate that the latency between sending and receiving a GOOSE message among participants is within its maximum time span defined by the IEC 61850-90-5 working group for communications over the WAN.

The purpose of this article is to analyze the introduction and use of information and communication technologies (ICT) in the special disciplines of higher education, to teach teachers how to improve the effectiveness of teaching and learning through information and communication technologies (ICT). This article discusses the issues of improving the knowledge and skills of students through the use of modern information and communication technologies in the preparation of designers, increasing students' interest in the educational process and the ability to apply their knowledge in practice in the future. The focus is on the need to develop appropriate strategies for a new educational role and, in addition, to enhance the role of learners in integrating information and communication technologies (ICT) into the educational process. The role and perspective of the teachers was very important, highlighting them as key players in the process. The data show that there is a belief that the use of information and communication technologies (ICT) in the educational process will help increase the effectiveness of education and facilitate the organization of the educational process. In particular, it shows that the contribution of information and communication technologies (ICT) to the improvement of the educational process in educational institutions, where information and communication technologies (ICT) is an innovative factor, is high. Achieving this high level means that the educational institution must not only modernize technological means, but also change the models of teaching.

Cyber physical systems (CPS) integrate the physical and numerical worlds. Number of computing system connected with wireless networks and also transmits sensitive data in secure manner of network. Those platforms, however, are vulnerable to cyber-attacks on people, equipment, and the ecosystem. The method of transmitting sensed data to controllers through a wireless transmission link, therefore increasing the attack surface, attracts cyber concerns in CPS. Intrusion detection systems (IDS) are well-known as powerful survival mechanisms, and machine learning (ML) approaches have lately been employed in their creation. The conventional ML-based IDS, which need a considerable computing capacity, do not work on IoT devices as computational resources such as memory, processing power and limited energy are restricted. The proposed work is to build and implement a lightweight, resource-restricted IDS-based appliance. Moreover, the presents IMPACT, a lightweight IDS model based on ML (Impersonation Attack detection). This is built on extensive object detection using a gradation sequential Support Vector Machine (SVM) to reduce the amount of variables via feature selection and extraction utilizing a C4.8 wrapper, mutual information (MI), and stacked autoencoder (SAE), to install and operate on resource-constrained devices. Using the Aegean Wi-Fi Intruder Dataset (AWID), the IMPACT taught to detect impersonator attacks. The suggested IMPACT model surpassed current state-of-the-art benchmark techniques, achieving 98.23% accuracy, 1.21% false alarm rate, and 97.65 % detection rate.

The real-time (RT) hardware-in-the-loop (HIL) simulation-based testing is getting popular for power systems and power electronics applications. The HIL testing provides the interactive environment between the actual power system components like control and protection devices and simulated power system networks including different communication protocols. Therefore, the results of the RT simulation and HIL testing before the actual implementation in the field are generally more acceptable than offline simulations. This paper reviews the HIL testing methods and applications in the recent literature and presents a step-by-step documentation of a new HIL testing setup for a specific case study. The case study evaluates real-time implementation of previously proposed communication-dependent logically selective adaptive protection algorithm of AC microgrids using HIL testing of IEC 61850 generic object-oriented substation event (GOOSE) protocol. The RT model of AC microgrid including the converter-based distributed energy resources and battery storage along with IEC 61850 GOOSE protocol implementation is created in MATLAB/Simulink and RT-LAB software using OPAL-RT simulator platform. Local area network (LAN) at the laboratory acts as IEC 61850 station bus for exchanging GOOSE Boolean signals between the RT target and the actual digital relay. The evaluation of the round-trip delay using the RT simulation has been performed. It is found that the whole process of fault detection, isolation and adaptive setting using Ethernet communication is possible within the standard low voltage ride through curve maintaining the seamless transition to the islanded mode. The signal monitoring inside the relay is suggested to avoid false tripping of the relay.

Reliability assessment of a power system with cyber-physical interactive operation of photovoltaic systems