{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,8]],"date-time":"2026-05-08T16:14:55Z","timestamp":1778256895150,"version":"3.51.4"},"reference-count":35,"publisher":"MDPI AG","issue":"5","license":[{"start":{"date-parts":[[2021,5,8]],"date-time":"2021-05-08T00:00:00Z","timestamp":1620432000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Ministry of Energy, Transportation and Infrastructure","award":["2019"],"award-info":[{"award-number":["2019"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Symmetry"],"abstract":"<jats:p>Increased connectivity is required to implement novel coordination and control schemes. IEC 61850-based communication solutions have become popular due to many reasons\u2014object-oriented modeling capability, interoperable connectivity and strong communication protocols, to name a few. However, communication infrastructure is not well-equipped with cybersecurity mechanisms for secure operation. Unlike online banking systems that have been running such security systems for decades, smart grid cybersecurity is an emerging field. To achieve security at all levels, operational technology-based security is also needed. To address this need, this paper develops an intrusion detection system for smart grids utilizing IEC 61850\u2019s Generic Object-Oriented Substation Event (GOOSE) messages. The system is developed with machine learning and is able to monitor the communication traffic of a given power system and distinguish normal events from abnormal ones, i.e., attacks. The designed system is implemented and tested with a realistic IEC 61850 GOOSE message dataset under symmetric and asymmetric fault conditions in the power system. The results show that the proposed system can successfully distinguish normal power system events from cyberattacks with high accuracy. This ensures that smart grids have intrusion detection in addition to cybersecurity features attached to exchanged messages.<\/jats:p>","DOI":"10.3390\/sym13050826","type":"journal-article","created":{"date-parts":[[2021,5,10]],"date-time":"2021-05-10T02:54:58Z","timestamp":1620615298000},"page":"826","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":75,"title":["Machine Learning-Based Intrusion Detection for Achieving Cybersecurity in Smart Grids Using IEC 61850 GOOSE Messages"],"prefix":"10.3390","volume":"13","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-2413-8421","authenticated-orcid":false,"given":"Taha Selim","family":"Ustun","sequence":"first","affiliation":[{"name":"Fukushima Renewable Energy Institute, AIST (FREA), National Institute of Advanced Industrial Science and Technology (AIST), Koriyama 963-0298, Japan"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7779-8140","authenticated-orcid":false,"given":"S. M. Suhail","family":"Hussain","sequence":"additional","affiliation":[{"name":"Department of Computer Science, School of Computing, National University of Singapore, Singapore 637551, Singapore"}]},{"given":"Ahsen","family":"Ulutas","sequence":"additional","affiliation":[{"name":"Department of Electrical and Electronics Engineering, Necmettin Erbakan University, 42090 Konya, Turkey"}]},{"given":"Ahmet","family":"Onen","sequence":"additional","affiliation":[{"name":"Department of Electrical and Electronics Engineering, Abdullah Gul University, 38170 Kayseri, Turkey"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4761-1736","authenticated-orcid":false,"given":"Muhammad M.","family":"Roomi","sequence":"additional","affiliation":[{"name":"Advanced Digital Sciences Center, Illinois at Singapore Pte Ltd., University of Illinois at Urbana-Champaign, Singapore 138602, Singapore"}]},{"given":"Daisuke","family":"Mashima","sequence":"additional","affiliation":[{"name":"Advanced Digital Sciences Center, Illinois at Singapore Pte Ltd., University of Illinois at Urbana-Champaign, Singapore 138602, Singapore"}]}],"member":"1968","published-online":{"date-parts":[[2021,5,8]]},"reference":[{"key":"ref_1","unstructured":"Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions (2020, December 18). Smart Grids: From Innovation to Deployment. Available online: https:\/\/bit.ly\/3r7Zv8T."},{"key":"ref_2","unstructured":"Gangale, F., Vasiljevska, J., Covrig, F., Mengolini, A., and Fulli, G. (2017). Smart Grid Projects Outlook 2017: Facts, Figures and Trends in Europe, Publications Office of the EU. EUR 28614 EN."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"4219","DOI":"10.1109\/ACCESS.2018.2888880","article-title":"IEC 61850-Based Communication Modeling of EV Charge-Discharge Management for Maximum PV Generation","volume":"7","author":"Ustun","year":"2019","journal-title":"IEEE Access"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Nadeem, F., Aftab, M.A., Hussain, S.S., Ali, I., Tiwari, P.K., Goswami, A.K., and Ustun, T.S. (2019). Virtual Power Plant Management in Smart Grids with XMPP Based IEC 61850 Communication. Energies, 12.","DOI":"10.3390\/en12122398"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"141696","DOI":"10.1109\/ACCESS.2020.3013264","article-title":"IEC 61850 Modeling of UPFC and XMPP Communication for Power Management in Microgrids","volume":"8","author":"Ustun","year":"2020","journal-title":"IEEE Access"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"1302","DOI":"10.1109\/TLA.2020.9099773","article-title":"Dynamic Adaptive Protection based on IEC 61850","volume":"18","author":"Ferrari","year":"2020","journal-title":"IEEE Lat. Am. Trans."},{"key":"ref_7","unstructured":"International Electrotechnical Commission (2013). IEC TR 61850-1:2013, Communication Networks and Systems for Power Utility Automation\u2014Part 1: Introduction and Overview, International Standard."},{"key":"ref_8","unstructured":"International Electrotechnical Commission (2020). IEC TR 61850-8-1:2011, Communication Networks and Systems for Power Utility Automation\u2014Part 8-1: Specific Communication Service Mapping (SCSM)\u2014Mappings to MMS (ISO 9506-1 and ISO 9506-2) and to ISO\/IEC 8802-3, International Standard."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"106008","DOI":"10.1016\/j.ijepes.2020.106008","article-title":"IEC 61850 based substation automation system: A survey","volume":"120","author":"Aftab","year":"2020","journal-title":"Int. J. Electr. Power Energy Syst."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"468","DOI":"10.1016\/j.jesit.2018.01.001","article-title":"Smart grids security challenges: Classification by sources of threats","volume":"5","author":"Otuoze","year":"2018","journal-title":"J. Electr. Syst. Inf. Technol."},{"key":"ref_11","unstructured":"International Electrotechnical Commission (2020). IEC 62351-Power Systems Management and Associated Information Exchange\u2014Data and Communications Security, International Standard."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"26162","DOI":"10.1109\/ACCESS.2020.2971011","article-title":"Implementing Secure Routable GOOSE and SV Messages Based on IEC 61850-90-5","volume":"8","author":"Ustun","year":"2020","journal-title":"IEEE Access"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"2565","DOI":"10.1109\/TPWRD.2020.2990760","article-title":"A Method for Achieving Confidentiality and Integrity in IEC 61850 GOOSE Messages","volume":"35","author":"Hussain","year":"2020","journal-title":"IEEE Trans. Power Deliv."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Farooq, S.M., Hussain, S.M.S., Kiran, S., and Ustun, T.S. (2019). Certificate Based Security Mechanisms in Vehicular Ad-Hoc Networks based on IEC 61850 and IEEE WAVE Standards. Electronics, 8.","DOI":"10.3390\/electronics8010096"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Farooq, S.M., Hussain, S.M.S., Kiran, S., and Ustun, T.S. (2018). Certificate Based Authentication Mechanism for PMU Communication Networks Based on IEC 61850-90-5. Electronics, 7.","DOI":"10.3390\/electronics7120370"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Cuellar, J. (2013). A Holistic View of Security and Privacy Issues in Smart Grids. Smart Grid Security. SmartGridSec 2012, Springer.","DOI":"10.1007\/978-3-642-38030-3"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"80980","DOI":"10.1109\/ACCESS.2019.2923728","article-title":"Analysis and Implementation of Message Authentication Code (MAC) Algorithms for GOOSE Message Security","volume":"7","author":"Hussain","year":"2019","journal-title":"IEEE Access"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"32343","DOI":"10.1109\/ACCESS.2019.2902571","article-title":"Performance Evaluation and Analysis of IEC 62351-6 Probabilistic Signature Scheme for Securing GOOSE Messages","volume":"7","author":"Farooq","year":"2019","journal-title":"IEEE Access"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"107679","DOI":"10.1016\/j.comnet.2020.107679","article-title":"A survey on intrusion detection and prevention systems in digital substations","volume":"184","author":"Quincozes","year":"2021","journal-title":"Comput. Netw."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Hong, J., Liu, C., and Govindarasu, M. (2014, January 19\u201322). Detection of cyber intrusions using network-based multicast messages for substation automation. Proceedings of the Innovative Smart Grid Technologies (ISGT), Washington, DC, USA.","DOI":"10.1109\/ISGT.2014.6816375"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Prisco, A.F.S., and Duitama, M.J.F. (2017, January 16\u201318). Intrusion detection system for SCADA platforms through machine learning algorithms. Proceedings of the 2017 IEEE Colombian Conference on Communications and Computing (COLCOM), Cartagena, Colombia.","DOI":"10.1109\/ColComCon.2017.8088210"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Stiller, B., and De Turck, F. (2010). Intrusion Detection in SCADA Networks. Mechanisms for Autonomous Management of Networks and Services. AIMS 2010, Springer.","DOI":"10.1007\/978-3-642-13986-4"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Nsonga, P., Hussain, S.M.S., Ali, I., and Ustun, T.S. (December, January 14). Using IEC 61850 and IEEE WAVE standards in ad-hoc networks for electric vehicle charging management. Proceedings of the 2016 IEEE Online Conference on Green Communications (OnlineGreenComm), Piscataway, NJ, USA.","DOI":"10.1109\/OnlineGreenCom.2016.7805404"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Liu, N., Chen, J., Luo, H., and Liu, W. (2011, January 25\u201328). A Preliminary Communication Model of Smart Meter Based on IEC 61850. Proceedings of the 2011 Asia-Pacific Power and Energy Engineering Conference, Wuhan, China.","DOI":"10.1109\/APPEEC.2011.5748756"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Kim, H.J., Jeong, C.M., Sohn, J.-M., Joo, J.-Y., Donde, V., Ko, Y., and Yoon, Y.T. (2020). A Comprehensive Review of Practical Issues for Interoperability Using the Common Information Model in Smart Grids. Energies, 13.","DOI":"10.3390\/en13061435"},{"key":"ref_26","unstructured":"International Electrotechnical Commission (2020). IEC 62351-6: Power Systems Management and Associated Information Exchange\u2014Data and Communications Security\u2014Part 6: Security for IEC 61850, International Standard."},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Boakye-Boateng, K., and Lashkari, A.H. (2019, January 1\u20133). Securing GOOSE: The Return of One-Time Pads. Proceedings of the 2019 International Carnahan Conference on Security Technology (ICCST), Chennai, India.","DOI":"10.1109\/CCST.2019.8888435"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Cai, J., Zheng, Y., and Zhou, Z. (2016, January 19\u201322). Review of cyber-security challenges and measures in smart substation. Proceedings of the 2016 International Conference on Smart Grid and Clean Energy Technologies (ICSGCE), Chengdu, China.","DOI":"10.1109\/ICSGCE.2016.7876027"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"5643","DOI":"10.1109\/TII.2019.2956734","article-title":"A Review of IEC 62351 Security Mechanisms for IEC 61850 Message Exchanges","volume":"16","author":"Hussain","year":"2020","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"156044","DOI":"10.1109\/ACCESS.2019.2948117","article-title":"A Novel Approach for Mitigation of Replay and Masquerade Attacks in Smartgrids Using IEC 61850 Standard","volume":"7","author":"Ustun","year":"2019","journal-title":"IEEE Access"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"56486","DOI":"10.1109\/ACCESS.2021.3071141","article-title":"Artificial Intelligence Based Intrusion Detection System for IEC 61850 Sampled Values Under Symmetric and Asymmetric Faults","volume":"9","author":"Ustun","year":"2021","journal-title":"IEEE Access"},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Farooq, S.M., Hussain, S.M., and Ustun, T.S. (2019). S-GoSV: Framework for Generating Secure IEC 61850 GOOSE and Sample Value Messages. Energies, 12.","DOI":"10.3390\/en12132536"},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Biswas, P.P., Tan, H.C., Zhu, Q., Li, Y., Mashima, D., and Chen, B. (2019, January 21\u201323). A Synthesized Dataset for Cybersecurity Study of IEC 61850 based Substation. Proceedings of the 2019 IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SmartGridComm), Beijing, China.","DOI":"10.1109\/SmartGridComm.2019.8909783"},{"key":"ref_34","unstructured":"(2020, December 18). Available online: https:\/\/github.com\/smartgridadsc\/IEC61850SecurityDataset."},{"key":"ref_35","unstructured":"(2020, December 02). Available online: https:\/\/selinc.com\/products\/3355\/."}],"container-title":["Symmetry"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-8994\/13\/5\/826\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T05:58:22Z","timestamp":1760162302000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-8994\/13\/5\/826"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,5,8]]},"references-count":35,"journal-issue":{"issue":"5","published-online":{"date-parts":[[2021,5]]}},"alternative-id":["sym13050826"],"URL":"https:\/\/doi.org\/10.3390\/sym13050826","relation":{},"ISSN":["2073-8994"],"issn-type":[{"value":"2073-8994","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,5,8]]}}}