⚡ electrical engineering

Explainable Autoencoder-Based Anomaly Detection in IEC 61850 GOOSE Networks

This paper proposes an explainable, unsupervised multi-view autoencoder framework that effectively detects diverse cyberattacks in IEC 61850 GOOSE networks by learning distinct latent representations of protocol semantics and timing dynamics from normal traffic, achieving high detection rates with low false positives and intrinsic interpretability.

Original authors: Dafne Lozano-Paredes, Luis Bote-Curiel, Juan Ramón Feijóo-Martínez, Ismael Gómez-Talal, José Luis Rojo-Álvarez

Published 2026-01-15

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Dafne Lozano-Paredes, Luis Bote-Curiel, Juan Ramón Feijóo-Martínez, Ismael Gómez-Talal, José Luis Rojo-Álvarez

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a digital substation as a high-speed, high-stakes control room for a city's power grid. Inside this room, thousands of tiny electronic devices (called IEDs) are constantly talking to each other to keep the lights on and prevent blackouts. They use a special language called GOOSE (Generic Object-Oriented Substation Event) to send urgent messages like "Switch this breaker!" or "Stop the flow!"

The problem is that this language was designed for speed, not security. It's like sending a postcard instead of a locked envelope. Because it's so fast, it doesn't have built-in locks or passwords. This means a hacker could potentially sneak in, pretend to be a legitimate device, and send fake orders that could cause real-world damage.

The Challenge: Finding the Needle in a Haystack

Traditional security systems are like bouncers with a "Wanted" poster. They only catch people who look exactly like known criminals. But hackers are clever; they can dress up like normal people (known as "zero-day" attacks) or use new tricks the bouncer has never seen. Also, in a real power grid, attacks are incredibly rare. You might have a million normal messages for every single bad one. This makes it hard to train a computer to spot the bad ones without crying wolf constantly.

The Solution: The "Explainable" Double-Check System

The authors of this paper propose a new security guard that doesn't need a "Wanted" poster. Instead, it learns what normal behavior looks like and flags anything that feels "off." They call this an Explainable Autoencoder Framework.

Here is how it works, using a simple analogy:

1. The Two-View Approach (The "What" and the "When")

The system splits the traffic into two separate categories to understand the conversation better:

Semantic Integrity (The "What"): This looks at the content of the message. In the GOOSE language, messages have strict rules, like a sequence of numbers that must go up by one every time (1, 2, 3...). If a message says "2" then suddenly "5," that's a broken rule.
Temporal Availability (The "When"): This looks at the timing. Messages arrive at very predictable intervals. If a flood of messages suddenly arrives all at once, or if messages stop coming for too long, that's suspicious.

2. The "Autoencoder" (The Memory Game)

Imagine a student who has studied a textbook of "perfect" GOOSE messages for months. This student is an Autoencoder.

Training: The student is shown only normal, healthy traffic. They learn to compress these messages into a tiny mental summary and then expand them back out perfectly.
The Test: When a new message arrives, the student tries to compress it and expand it again.
- If the message is normal, the student can recreate it perfectly.
- If the message is a hacker's fake (even if it looks like a normal message), the student gets confused. They can't recreate it accurately. The "error" in their reconstruction is huge.
The Alarm: A big error means "Anomaly Detected!"

3. Why It's "Explainable" (The Detective Work)

Most AI systems are "black boxes"—they say "Attack!" but you don't know why. This system is different. Because it breaks the message down into specific parts (like the sequence numbers or the timing), it can point a finger and say:

"I flagged this because the sequence number jumped from 10 to 50, which breaks the rules."
"I flagged this because 1,000 messages arrived in one second, which is impossible for normal traffic."

This is crucial for engineers. They don't just get an alarm; they get a reason, which helps them fix the problem quickly.

The Results: Catching the Bad Guys Without Crying Wolf

The researchers tested this system using real data from a power substation in Spain and a public dataset containing simulated attacks. They looked for three types of attacks:

Message Suppression: Hiding messages so devices don't get updates.
Data Manipulation: Changing the content of a message (e.g., telling a breaker to open when it should stay closed).
Denial-of-Service (DoS): Flooding the network with junk to drown out real messages.

The findings were impressive:

High Success Rate: The system caught more than 99% of the attacks.
Low False Alarms: It only raised a false alarm less than 5% of the time. In a world with millions of messages, this means the security team isn't overwhelmed by fake alerts.
Generalization: It worked well even though it was trained only on normal traffic and never saw the specific attacks during training. It learned the "rules of the game" so well that it could spot anyone breaking them.

The Bottom Line

This paper presents a smart, adaptable security guard for power grids. Instead of memorizing a list of known criminals, it learns the rhythm and rules of normal conversation. If someone tries to break the rhythm or the rules, the system spots it immediately and explains exactly what went wrong. This makes it a powerful tool for protecting critical infrastructure against both known and brand-new cyber threats.

Technical Summary: Explainable Autoencoder-Based Anomaly Detection in IEC 61850 GOOSE Networks

Problem Statement
The IEC 61850 Generic Object-Oriented Substation Event (GOOSE) protocol is critical for real-time protection and automation in digital substations. However, its design prioritizes low-latency communication over security, lacking native encryption or authentication mechanisms. This vulnerability exposes power systems to sophisticated cyberattacks, including Message Suppression (MS), Data Manipulation (DM), and Denial-of-Service (DoS). Traditional rule-based and supervised intrusion detection systems (IDS) struggle in this context due to their reliance on known attack signatures, the scarcity of labeled attack data in operational environments, and the challenge of detecting zero-day or protocol-compliant attacks that mimic legitimate behavior. Furthermore, the extreme class imbalance between normal traffic and rare attack events complicates the training of supervised models.

Methodology
The paper proposes an unsupervised, explainable, multi-view anomaly detection framework that explicitly separates semantic integrity (protocol sequencing rules) from temporal availability (timing and transmission dynamics). The methodology proceeds through the following stages:

Feature Engineering: GOOSE traffic is processed using sliding windows ( $T_w$ ) of 0.1, 0.5, 1.0, and 3.0 seconds. Features are decomposed into two disjoint sets:
- Sequence-based features ( $F_{seq}$ ): Derived from IEC 61850 application-layer semantics, including state number increments ($stNum$), sequence number evolution ($sqNum$), and destination address validity.
- Temporal features ( $F_{temp}$ ): Describing transmission dynamics, including inter-arrival times, packet rates, jitter, frame lengths, and Time-Allowed-To-Live (TTL) values.
Asymmetric Autoencoder (AE) Architecture: Two distinct Autoencoders are trained exclusively on real-world operational GOOSE traffic (containing only normal data):
- A Semantic AE processes $F_{seq}$ using a deeper architecture to capture nonlinear protocol dependencies.
- A Temporal AE processes $F_{temp}$ using a narrower bottleneck to prevent the reconstruction of volumetric flooding behaviors.
- Both models learn a compressed latent representation of normal traffic.
Anomaly Scoring and Thresholding: Anomaly detection is based on the reconstruction error (Mean Squared Error) of the input data. Instead of fixed thresholds, the framework employs Extreme Value Theory (EVT) to model the tail of the reconstruction error distribution from the normal training data. This yields statistically grounded, dynamic thresholds ( $z^*$ ) for each view. A window is flagged as anomalous if the error in either the semantic or temporal view exceeds its respective threshold.
Explainability: The framework provides intrinsic interpretability by decomposing the anomaly score into per-feature contributions based on squared reconstruction errors. This links detection outcomes directly to specific IEC 61850 protocol characteristics without requiring surrogate models.

Key Contributions

Multi-View Separation: The explicit decoupling of semantic and temporal dynamics allows the model to address the distinct behavioral modalities of GOOSE traffic, which are often conflated in single-model approaches.
Unsupervised Learning with Real Data: The approach eliminates the dependency on labeled attack data for training, utilizing only real operational traffic to learn normal behavior, thereby addressing the scarcity of attack samples in industrial control systems.
Statistically Grounded Thresholding: The use of EVT for dynamic thresholding ensures robust detection under severe class imbalance while maintaining control over false positives.
Intrinsic Explainability: By analyzing feature-level reconstruction errors, the system offers direct insights into why an anomaly was detected, aligning with specific protocol violations (e.g., sequence number discontinuities or timing floods).

Experimental Results
The framework was evaluated using a real-world dataset from a high-voltage substation (for training) and a public dataset containing labeled MS, DM, and DoS attacks (for testing).

Detection Performance: The Semantic AE consistently achieved high recall (often 1.00) across all attack types and window sizes, effectively detecting interruptions in sequencing rules. The Temporal AE showed lower precision due to the inherent variability of timing features but maintained recall above 0.80 for most scenarios.
False Positives: The proportion of false positives remained below 5% of the total traffic volume, a level deemed acceptable for operational substations where attacks are rare.
Window Size Impact: Intermediate window lengths ( $T_w = 0.5$ s and $1.0$ s) provided the optimal trade-off between temporal resolution and stability. Shorter windows ($0.1$ s) increased sensitivity to noise, while longer windows ($3.0$ s) smoothed out short-lived anomalies.
Generalization: The model demonstrated strong generalization, mapping both real-world baseline traffic and synthetic normal samples to the same compact latent region, while separating attack samples into distinct regions.

Significance and Claims
The authors claim that this framework offers a robust solution for anomaly detection in IEC 61850 GOOSE networks, particularly in scenarios where labeled attack data is unavailable. By separating semantic and temporal views, the system captures complementary aspects of GOOSE behavior that single-model detectors miss. The combination of asymmetric autoencoders, EVT-based thresholding, and feature-level attribution enables accurate detection of MS, DM, and DoS attacks with interpretable outcomes. The paper posits that this approach is suitable for operational settings, including those involving previously unseen attacks, by relying on the fundamental structure of normal protocol behavior rather than specific attack signatures.