Comparative Study of Machine Learning Models for Intrusion Detection in SCADA Communication Based on IEC 60870-5-104

Abstract

IEC 60870-5-104 (IEC-104) is widely deployed in SCADA-based power systems to transport telecontrol messages over TCP/IP. While improving interoperability, this connectivity expands the cyber attack surface and enables threats targeting both availability and integrity. This paper presents a comparative evaluation of supervised machine learning (ML) models for intrusion detection on IEC-104 communication using a laboratory SCADA testbed and labeled datasets derived from packet captures. Three representative scenarios are considered: SYN Flood targeting TCP port 2404 (Layer 4 denial-of-service), APDU Flood at the application layer (Layer 7 denial-ofservice), and Control Command Injection Attack (CCIA) via man-in-the-middle command manipulation (integrity attack). Features are extracted using TShark and combine transport/network indicators with IEC-104-aware attributes (APDU length, I/S/U frame type, ASDU Type ID, Cause of Transmission, and IOA), consistent with the importance of protocol-aware inspection in IEC-104 IDS research. Evaluation uses stratified random record-level splitting for SYN Flood due to limited sample size and time-based hold-out validation for the combined APDU+CCIA dataset to assess temporal generalization. Results show that SYN Flood is detected reliably with tuned SVM achieving 85.57% accuracy and perfect recall (100%). Under time-based validation on APDU+CCIA, overall performance remains high (accuracy 98.54%-99.39%) and APDU Flood detection is near-perfect (accuracy 99.02%-99.87%), whereas CCIA detection accuracy $(\mathbf{5 2. 3 0 \% - 6 0. 6 2 \%})$ remains substantially lower, indicating the need for richer semantic and temporal features for integrity-focused anomalies in IEC-104 traffic.