AS-SRDT: Semi-Supervised Anomaly Detection for IEC 61850 GOOSE Communication Using Anomaly-Score Supervision With Restricted Distribution Transformation
TL;DR
A semi-supervised anomaly detection framework that incorporates explicit anomaly-score supervision into the restricted distribution transformation paradigm is proposed and demonstrates that the proposed approach consistently outperforms baseline anomaly detection methods in terms of Matthews Correlation Coefficient (MCC) and F1-score.
Abstract
Intrusion detection for IEC 61850 Generic Object-Oriented Substation Events (GOOSE) communication is critical for safeguarding substation automation systems (SAS). However, practical deployment is severely constrained by the extreme scarcity of labeled anomalous events and the lack of a reliable mechanism for learning stable and continuously varying anomaly scores, where score magnitudes should faithfully reflect the likelihood of abnormal behavior. To address these challenges, this paper proposes a semi-supervised anomaly detection framework that incorporates explicit anomaly-score supervision into the restricted distribution transformation paradigm. The proposed method leverages a small number of labeled anomalous samples together with abundant normal data. It further imposes a form of heuristic regularization by encouraging score-level consistency on interpolation-based intermediate samples, thereby enabling stable and continuous anomaly-score learning under highly imbalanced conditions. Experimental results under a packet-level evaluation protocol on a synthesized IEC 61850 GOOSE dataset derived from a 66/11 kV distribution substation model demonstrate that the proposed approach consistently outperforms baseline anomaly detection methods in terms of Matthews Correlation Coefficient (MCC) and F1-score. Additional reference-assisted cross-domain evaluation on an independent HIL-based IEC 61850 dataset, collected from a real-time cyber–physical testbed comprising an OPAL-RT real-time power-system simulator, an SEL merging unit, and SEL protective IEDs representing a 115/13.8 kV substation environment, uses a small number of normal target-domain reference samples during inference. The results demonstrate that anomaly-score normalization improves cross-domain score calibration for all evaluated methods, while AS-SRDT shows particularly strong performance under the same normalization setting, especially under severe cross-domain mismatch and low-reference conditions. These findings provide packet-level benchmark evidence of the effectiveness of AS-SRDT under severe anomaly scarcity within the evaluated dataset setting.