FARIMA model-based communication traffic anomaly detection in intelligent electric power substations

Abstract

The technological advances of intelligent electric substations have significantly improved the operational performance of power utilities by incorporating advanced monitoring and control functionalities. The data traffic patterns in substation communication network (SCN) need to be better understood to improve the SCN performance against different forms of cyber-attacks. To this end, this study presents a fractional auto-regressive integrated moving average (FARIMA)-based threshold model to characterise the SCN traffic flow based on the IEC 61850 protocol and carry out anomaly detection. The performance of the proposed anomaly detection solution is assessed and validated through numerical analysis under the condition of the cyber storm based on the collected SCN data traffic from a real 110 kV substation, and the numerical results clearly confirmed its effectiveness.