Machine Learning-Based Feature Selection for Intrusion Detection Systems in IEC 61850-Based Digital Substations

With the evolution in attack surfaces, smart grid complexity, and adversary models, conventional defense solutions in the smart grid domain have become less effective in providing adequate protection. In recent years, machine learning-based intrusion detection systems have been a current research topic, offering a promising and reliable defense against advanced threats. This work focuses on the development of a machine learning-based feature selection algorithm for a robust and efficient detection of attacks specifically targeting the Sampled Values and Manufacturing Message Specification protocols widely used in IEC 61850-based substations. For dataset generation, we implement several cyber-physical attacks such as injection, replay, time delay, and data modification attacks against a hardware-based substation test environment at KASTEL Security Lab Energy. The generated datasets are used to build and evaluate the developed feature selection algorithm. Our findings show that even a small number of carefully selected features can lead to more efficient and accurate anomaly detection. Considering the scarcity of datasets for smart grids, we have also released our datasets to the community for further analysis and evaluation of data-driven defense mechanisms for digital substations.