Scholarlink

<p>IEC 61850 communications in digital substations require intrusion detection methods that can operate under very low false-alarm budgets while remaining sensitive to both availability disruption and integrity manipulation. This paper presents a tail-calibrated mixture of experts detector for ultra-low false-alarm intrusion detection in IEC 61850 traffic. The method integrates three complementary evidence streams: an availability-focused autoencoder that models timing, rate, volume, and protocol composition regularities; an integrity-focused autoencoder that models semantic, value, and counter related consistency in GOOSE and SV derived features; and a CUSUM-based timing change detector for persistent rate and inter-arrival time deviations. Expert scores are learned and standardized using baseline-only data, converted into calibrated right tail probabilities using empirical or EVT smoothed survival estimates, and fused using a Fisher-style evidence combination statistic. The fused score is thresholded on held-out baseline windows to report detection at fixed false positive rates of <InlineEquation ID="IEq1"> <EquationSource Format="TEX">\(10^{-4}\)</EquationSource> </InlineEquation> and <InlineEquation ID="IEq2"> <EquationSource Format="TEX">\(10^{-3}\)</EquationSource> </InlineEquation>. Evaluation on SGSim-generated IEC 61850 traces shows that the proposed method matches the strongest timing-centric detectors at <InlineEquation ID="IEq3"> <EquationSource Format="TEX">\(\textrm{FPR}=10^{-4}\)</EquationSource> </InlineEquation> and improves overall detection at <InlineEquation ID="IEq4"> <EquationSource Format="TEX">\(\textrm{FPR}=10^{-3}\)</EquationSource> </InlineEquation>, while providing explainable diagnostics through expert contribution decomposition and feature group residual attributions. The results demonstrate that tail-calibrated expert fusion is a practical and interpretable approach for IEC 61850 anomaly detection under stringent false-alarm constraints, while also highlighting the need for further validation on real substations, heterogeneous devices, benign disturbances, and additional attack classes.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Tail-calibrated mixture of experts for ultra-low false-alarm intrusion detection in IEC 61850 communications

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年7月11日

查看全文
  • Livinus Obiora Nweke

摘要

IEC 61850 communications in digital substations require intrusion detection methods that can operate under very low false-alarm budgets while remaining sensitive to both availability disruption and integrity manipulation. This paper presents a tail-calibrated mixture of experts detector for ultra-low false-alarm intrusion detection in IEC 61850 traffic. The method integrates three complementary evidence streams: an availability-focused autoencoder that models timing, rate, volume, and protocol composition regularities; an integrity-focused autoencoder that models semantic, value, and counter related consistency in GOOSE and SV derived features; and a CUSUM-based timing change detector for persistent rate and inter-arrival time deviations. Expert scores are learned and standardized using baseline-only data, converted into calibrated right tail probabilities using empirical or EVT smoothed survival estimates, and fused using a Fisher-style evidence combination statistic. The fused score is thresholded on held-out baseline windows to report detection at fixed false positive rates of \(10^{-4}\) and \(10^{-3}\) . Evaluation on SGSim-generated IEC 61850 traces shows that the proposed method matches the strongest timing-centric detectors at \(\textrm{FPR}=10^{-4}\) and improves overall detection at \(\textrm{FPR}=10^{-3}\) , while providing explainable diagnostics through expert contribution decomposition and feature group residual attributions. The results demonstrate that tail-calibrated expert fusion is a practical and interpretable approach for IEC 61850 anomaly detection under stringent false-alarm constraints, while also highlighting the need for further validation on real substations, heterogeneous devices, benign disturbances, and additional attack classes.