Cyber security of IEC-61850 enabled substations Stealthy GOOSE Data Generation and Unsupervised Intrusion Detection in IEC-61850 Substations

The modernization of power systems introduces significant cybersecurity vulnerabilities in IEC 61850-based digital substations, yet existing research predominantly focuses on easily detectable, high-volume threats. Stealthy, protocol-conformant attacks remain underrepresented, largely due to the scarcity of high-fidelity public datasets.

This thesis addresses this gap by constructing a multi-vendor hardware-in-the-loop testbed using commercial Intelligent Electronic Devices (IEDs) from ABB and Siemens, generating five publicly released, labeled Generic Object Oriented Substation Event (GOOSE) datasets covering normal operation and three progressively sophisticated attack levels. A baseline One-Class Support Vector Machine (OCSVM) evaluation confirms that detection difficulty scales directly with attacker sophistication, with the substation-state-aware attack requiring an operationally unacceptable false alarm rate to detect, demonstrating that such attacks represent a qualitatively different threat class that standard statistical detectors cannot reliably isolate.