Random Forest-based detection of cyber-attacks in substation automation systems in the context of IEC 61850 GOOSE communication protocol

Abstract

The development of the Smart Grid aims to improve the operation of the traditional grid through the incorporation of information and communication technology. This is typically done through the integration of communication networks and a set of protocols that make the electricity grid prone to cyberattacks. Cyberattack threats such as data manipulation and replay attacks typically target substation automation systems and hence causing severe damage to the electricity grid assets leading to significant economic loss. In order to make the smart grid more resilient to such cyberattacks, it is critical to detect such cyberattacks accurately. The work presented in this thesis looks into machine learning techniques and in particular the Random Forest as an ensemble classifier to detect and classify the cyberattacks from other power quality disturbances and normal operation. Furthermore, the thesis addresses the issue of identifying the key features that effectively help in detecting such cyberattacks.