Light-weight and Robust Network Intrusion Detection for Cyber-attacks in Digital Substations

This paper proposes a rule-based Network Intrusion Detection System (NIDS) to detect a wide range of cyber-attacks that target the specific protocol in power system protection applications. The proposed NIDS is based on the analysis of the normal behavior of the protocol, contrasted to attacker behavior aiming to affect the normal operation of an energy system by exploiting intrinsic vulnerabilities of the protocol. A set of time interval rules are derived to detect such cyber-attacks based on the time domain, while a sliding window mechanism is applied to handle the network jitter effect. The main advantages of the proposed solution are the robustness to network faults (i.e., network delays and packet loss) and the low attack detection time, which is less than 5% of the strict time delivery requirement of GOOSE messages.1- This work has been supported by m the Republic of Cyprus through the Deputy Ministry of Research, Innovation and Digital Policy. 2- Copyright note:© 2021 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. 3- Citation: M. F. Elrawy, L. Hadjidemetriou, C. Laoudias and M. K. Michael, "Light-weight and Robust Network Intrusion Detection for Cyber-attacks in Digital Substations," 2021 IEEE PES Innovative Smart Grid Technologies - Asia (ISGT Asia), 2021, pp. 1-5, doi: 10.1109/ISGTAsia49270.2021.9715626