Network traffic prediction for detecting DDoS attacks in IEC 61850 communication networks. (October 2020)

• Record Type: Journal Article
• Authors: da Silva, L.E.; Coury, D.V.
• Is Part Of: Computers & electrical engineering. Volume 87(2020)
• Publication Date: 2020-10
• Subjects: Traffic prediction -- Cyber attacks -- IEC 61850 -- Artificial neural networks -- Distributed Denial-of-Service; Computer engineering -- Periodicals; Electrical engineering -- Periodicals; Electrical engineering -- Data processing -- Periodicals; Ordinateurs -- Conception et construction -- Périodiques; Électrotechnique -- Périodiques; Électrotechnique -- Informatique -- Périodiques; Computer engineering; Electrical engineering; Electrical engineering -- Data processing; Periodicals; Electronic journals; 621.302854
• DOI: 10.1016/j.compeleceng.2020.106793
• Languages: English
• ISSNs: 0045-7906

Abstract

Abstract: This article presents the development of a Generic Object Oriented Substation Event (GOOSE) message traffic prediction system using a Nonlinear Autoregressive Model with Exogenous Input (NARX) input. An Artificial Neural Network was adopted to detect Distributed Denial-of-Service (DDoS) attacks in networks using the IEC-61850 protocol. The system uses the OpenFlow protocol to split the multicast groups of GOOSE messages, in which each transmission is analysed separately. The implemented intelligent system used 62 prediction steps with a percentage relative error of up to 5%. The system was embedded in the ZYBO development platform with the OpenMul controller. The results showed that the percentage relative error of each sample presents a determinant signature for classifying the state of operation of the electrical system, making it possible to identify DDoS attacks in communication networks for electric power substations.