Aug 2026· Journal of Electronics and Electrical Engineering· pp. 487-520· 0 citations
TL;DR
The review begins with the network architecture, representative protocols such as IEC 104, IEC 61850, and Distributed Network Protocol 3 (DNP3), and their associated security risks, thereby clarifying the foundational role of protocol-level visibility in power monitoring scenarios.
Abstract
Focusing on the typical characteristics of power monitoring systems—including dedicated protocols, stable communication relationships, stringent real-time requirements, and security incidents with severe operational consequences—this paper presents a systematic review of protocol analysis-based secure traffic monitoring and anomalous behavior detection. The review begins with the network architecture, representative protocols such as International Electrotechnical Commission (IEC) 104, IEC 61850, and Distributed Network Protocol 3 (DNP3), and their associated security risks, thereby clarifying the foundational role of protocol-level visibility in power monitoring scenarios. It then surveys protocol analysis methods, including deep packet inspection, flow-level feature analysis, machine learning, and hybrid identification approaches, as well as anomaly detection strategies targeting connection behavior, operational status, and physical consistency. On this basis, it further summarizes common issues in publicly available datasets, evaluation metrics, and experimental design. Existing studies indicate that related technologies are moving from single rule matching toward the coordinated use of protocol semantic understanding, behavioral modeling, and multi-layer fusion analysis. Nevertheless, substantial gaps remain in power-specific data resources, cross-scenario generalization, stealthy anomaly recognition, and engineering interpretability. Finally, the paper discusses future research directions in light of the practical requirements of power monitoring systems.
As MNI becomes increasingly vulnerable to new kinds of attacks from the cyber world, accurate and timely detection of intrusions becomes a primary key to the power of cybersecurity. More complex attack patterns, complex traffic interactions within large scales are not very collaborable with the typical signature-based detection methods. A Transformer Based Network Anomaly Detection System for intelligent cyber security monitoring based on network flow analysis (NFAs) is proposed in the paper. This framework is derived from the CICIDS2017 data-set and proposes 78 of the statistical flow characteristics, where each flow characteristic impacts the behaviour of a packet, protocol, volume of traffic and temporal communication pattern. The model uses a Transformer Encoder network architecture along with multiple heads of self-attention, which provides greater understanding to deal with complex relationships between features from network traffic. LabelEncoder and StandardScaler have been applied to the columns with values that need to be encoded for categorical variables and scaled to fit the values for models training. A trained model is then applied to progress multiple different categories of cyberattacks including DDoS attacks, PortScan, Brute Force, Botnet, Web Based, etc. and different kinds of traffic, all traffic is considered benign traffic. For providing real-time predictions, confidence interval, prediction of class severity and alerts using trained model an API developed on flask to connect the trained model to a dashboard was built. The experimental results show that the Transformer-based learning could be very effective in achieving successful capturing of the network behavior and conducting realistic detection. The overall proposed system offers an intelligent, scalable and deployment-centric approach to improve the monitoring and proactive detection of threats in contemporary networks in the field of cybersecurity.
S. Nagendrudu, Shaik Mohammed Anays, F. Mahammad et al.· 2026 International Conferenc...· 0 citations
The approach models inter-device state correlations using a heterogeneous graph structure and partitions behavior patterns through iterative community detection and automated semantic annotation, and represents normal behavior by embedding and clustering of state sequences.
Yifan Lu, Qixiao Lin, Jian Mao et al.· 0 citations
The fast-growing interconnectivity of networks and digital communication platforms, along with extensive information exchange, has made cybersecurity issues in modern computing environments more severe. The expansion of networking infrastructures always results in a massive flow of traffic, thus rendering traditional monitoring techniques and security tools ineffective. Modern cybersecurity systems often have problems detecting the changing nature of cyber threats since some of these have behaviors different from those associated with cyber attack signatures. This not only limits their effectiveness but also causes high rates of false alerts and late responses to complex threats like phishing, ransomware communications, distributed denial of service attacks, key logging activities, bot attacks, and packet sniffing. These all highlight the need for smart cybersecurity solutions that can analyze network activities effectively and detect any kind of threats. The designed model comprises two major layers, which are referred to as the data collection layer and the analysis layer. Network traffic details and system logs are collected using simulated or live data from either simulated or live environment and transformed into structured datasets to undergo the subsequent process steps. Preprocessing involves the removal of unnecessary data instances, cleansing of noise, and feature extraction to enable successful attack detection. This framework uses a combination of signature-based detection and anomaly detection methods to detect attacks through analysis of patterns that are consistent with an attack and patterns that are abnormal in terms of network behavior. This allows better detection of both current and new types of attacks. If a suspicious activity is observed in the network, then the design generates security alerts, stores the incident logs, and automatically responds by blocking the suspicious IP address.
D.NirmalaDevi, J. K. Jeevitha, P. M et al.· 2026 7th International Confe...· 0 citations
Smart grid communication systems rely on continuous data exchange among smart meters, substations, distributed energy resources, and control centers. Abnormal network traffic in these systems may indicate false data injection, denial-of-service attacks, unauthorized access, or compromised field devices. This study proposes an explainable ensemble learning framework for anomaly detection in smart grid communication traffic. The proposed model combines Random Forest, LightGBM, and Gradient Boosting through a weighted soft-voting mechanism to improve detection stability under imbalanced attack distributions. SHAP analysis is used to explain the contribution of flow-level and protocol-level features to each anomaly decision. Experiments are conducted on a smart grid communication dataset constructed from IEC 61850-based substation traffic and a power-system cyber-attack benchmark, containing 1.89 million labeled traffic records. After preprocessing and feature selection, 40 network features are retained, including packet inter-arrival time, flow duration, Modbus/TCP function frequency, byte transfer ratio, retransmission rate, and abnormal connection density. The proposed model achieves 98.11% accuracy, 97.36% F1-score, and 98.82% AUC in binary anomaly detection. For multi-class attack detection, it obtains a macro-F1 of 95.74% across false data injection, DoS, scanning, and unauthorized command attacks. Compared with standalone LightGBM, the ensemble model reduces the false positive rate by 14.2% and improves recall for low-frequency attack classes by 3.18%. SHAP interpretation shows that abnormal command frequency, short repetitive connections, packet timing instability, and asymmetric byte transfer are key indicators of malicious smart grid traffic. The results suggest that explainable ensemble learning can support transparent and reliable intrusion detection in smart grid communication environments
Min Jun Kim, Ji Eun Park, Seung Hyun Lee· The Journal of Applied Engi...· 0 citations
IEC 60870-5-104 (IEC-104) is widely deployed in SCADA-based power systems to transport telecontrol messages over TCP/IP. While improving interoperability, this connectivity expands the cyber attack surface and enables threats targeting both availability and integrity. This paper presents a comparative evaluation of supervised machine learning (ML) models for intrusion detection on IEC-104 communication using a laboratory SCADA testbed and labeled datasets derived from packet captures. Three representative scenarios are considered: SYN Flood targeting TCP port 2404 (Layer 4 denial-of-service), APDU Flood at the application layer (Layer 7 denial-ofservice), and Control Command Injection Attack (CCIA) via man-in-the-middle command manipulation (integrity attack). Features are extracted using TShark and combine transport/network indicators with IEC-104-aware attributes (APDU length, I/S/U frame type, ASDU Type ID, Cause of Transmission, and IOA), consistent with the importance of protocol-aware inspection in IEC-104 IDS research. Evaluation uses stratified random record-level splitting for SYN Flood due to limited sample size and time-based hold-out validation for the combined APDU+CCIA dataset to assess temporal generalization. Results show that SYN Flood is detected reliably with tuned SVM achieving 85.57% accuracy and perfect recall (100%). Under time-based validation on APDU+CCIA, overall performance remains high (accuracy 98.54%-99.39%) and APDU Flood detection is near-perfect (accuracy 99.02%-99.87%), whereas CCIA detection accuracy $(\mathbf{5 2. 3 0 \% - 6 0. 6 2 \%})$ remains substantially lower, indicating the need for richer semantic and temporal features for integrity-focused anomalies in IEC-104 traffic.
Sofyan Asyzauri, A. Affandi, P. H. Mukti et al.· International Seminar on Int...· 0 citations
This Extended Project Qualification investigates whether machine-learning-based anomaly detection systems introduce greater operational risk in automated smart grid protection controllers, that is, in latency and false-positive circuit-trip rates, than traditional regex-based and signature-based filtering. This project compares three detection methods, including Snort-based rule filtering, an Isolation Forest classifier, and an LSTM Autoencoder using a primary data based on an analysis of the bachirbarika Power System data, a testbed PMU and SCADA dataset consisting of 78,369 rows and 15 different attack scenarios with assistance provided by a review of peer-reviewed literature. Findings indicate that ML-based algorithms identify a significantly higher number of attacks compared to Snort in a setup where the attack is shown as a physical-state anomaly, not as an event on the network layer, but at the tradeoff of introducing a quantifiably higher false positive rate and, in the case of the Isolation Forest, a very great curiousness of inference. LSTM Autoencoder has a more refined portrait with similar accuracy on detection at a lower latency to the baseline of the rule-based. The findings indicate that hybrid-based approach to architecture should be suggested, where rule-based filtering is applied to address the time-sensitive deterministic checks, and the ML models give the context-driven anomaly analysis on both the SCADA and the wide-area layers. All the differences in the latencies were statistically significant, as tested with Mann-Whitney U at p < 0.001.
Wenxuan Cao· Science and Technology of En...· 0 citations
