kth.sePublications KTH
Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Exploring Cross-Substation Transfer Learning for Improving Cybersecurity in IEC 61850 Substations
Uppsala Univ, Dept Elect Engn, S-75230 Uppsala, Sweden..
KTH, School of Electrical Engineering and Computer Science (EECS), Electrical Engineering, Electric Power and Energy Systems.ORCID iD: 0000-0003-3014-5609
Uppsala Univ, Dept Elect Engn, S-75230 Uppsala, Sweden..
2025 (English)In: IEEE Access, E-ISSN 2169-3536, Vol. 13, p. 119500-119511Article in journal (Refereed) Published
Abstract [en]

The information security of IEC 61850-compliant substations is a growing concern for researchers and industry practitioners. IEC 62351, developed to address such concerns, recommends the use of intrusion detection systems (IDSs) as a defense, prompting extensive research on their development, particularly in data-driven approaches. Data-driven IDSs rely on high-quality and comprehensive training data. However, capturing complete datasets for each unique substation at scale is challenging due to the diverse and dynamic operating states between substations. Transfer learning (TL) has been shown to improve model performance in data-scarce environments; however, to the best of our knowledge, no prior work has formulated its use in the context of knowledge transfer between IEC 61850 substations. To address this gap, we propose cross-substation transfer learning (XSTL), a strategy that leverages knowledge transfer between substations that share the same protocol stack but differ in architecture. We demonstrate the value of XSTL using two publicly available datasets collected from substations with contrasting architectures, and show that XSTL can improve IDS performance compared to training IDSs in an isolated manner. Using data from a generic object-oriented substation event (GOOSE) flooding attack, we show that IDS performance is significantly improved in cross-domain tests (using data from two different substations) compared with baseline tests (using data from one substation), with statistical analyses confirming the significance of the improvement. These findings indicate that XSTL can reduce reliance on large datasets, thereby enabling more practical and scalable IDS development across substations where collecting diverse training data is challenging.

Place, publisher, year, edition, pages
IEEE-INST ELECTRICAL ELECTRONICS ENGINEERS INC , 2025. Vol. 13, p. 119500-119511
Keywords [en]
Substations, IEC Standards, Transfer learning, Taxonomy, Computer security, Protocols, Intrusion detection, Training data, Training, Standards, Cybersecurity, deep learning, IEC 61850, IEC 62351, smart grid security, machine learning
National Category
Computer Sciences
Identifiers
URN: urn:nbn:se:kth:diva-371845DOI: 10.1109/ACCESS.2025.3587923ISI: 001530173700007OAI: oai:DiVA.org:kth-371845DiVA, id: diva2:2011197
Note

QC 20251104

Available from: 2025-11-04 Created: 2025-11-04 Last updated: 2025-11-04Bibliographically approved

Open Access in DiVA

No full text in DiVA

Other links

Publisher's full text

Authority records

Nordström, Lars

Search in DiVA

By author/editor
Nordström, Lars
By organisation
Electric Power and Energy Systems
In the same journal
IEEE Access
Computer Sciences

Search outside of DiVA

GoogleGoogle Scholar

doi
urn-nbn

Altmetric score

doi
urn-nbn
Total: 37 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf