Analyzing GOOSE Security in IEC61850-based Substation Using ML, SDN and Digital Twin

This paper introduces a cyber digital twin (CDT) for supporting the analysis of power system substation network security and validating solutions utilizing Machine Learning (ML) and Software Defined Networking (SDN). This work focuses on targeted attacks against the Generic Object Oriented Sub-station Event (GOOSE) protocol. The developed CDT mirrors a realistic substation network consisting of a real-time digital simulator (RTDS), industry-graded hardware relays, merging units, SDN switches, and related communication networks. The CDT consists of a virtual network to which external devices can connect, an open-source SDN flow controller to specify network packet destination, OpenFlow protocol to configure packet flows, a custom-built GOOSE parser and builder, and an open-source library to facilitate GOOSE message exchange between external hosts. Two use cases of GOOSE spoofing attacks were conducted, which were successfully detected using novel feature engineering and a machine learning approach, yielding an accuracy of 95%, precision of 96%, and F-1 score of 96%. Finally, SDN was introduced as a potential solution to mitigate such GOOSE attacks from the bottom up. The overall study underlines the proposed CDT for substation network design's efficacy in improving overall network resilience against GOOSE integrity attacks, as well as its potential for developing and validating solutions for cyber attack defense and mitigation for real-world systems.