LSTM-Based Approach for Operational, Fault and Cyberattack Events Classification in Digital Substations: Frequency and Waveform Applications

This paper explores the application of Long Short-Term Memory (LSTM) networks to classify events in digital substations. Two classifiers were trained and validated using a public dataset and hardware-in-the-loop emulation applied to commercial substation equipment. The first classifier sorts events into three categories: electrical faults, cyberattacks, and normal operations, based on frequency data encapsulated into GOOSE packets. The second classifier is based on waveform information, encapsulated in Sampled Values packets, to identify normal operation events such as capacitor bank switching, load transfers, and transmission line reclosing. The two classifiers show promising results with 100% accuracy depending on the acquisition interval considered as input to the classifying models. This work highlights the practical applicability of these models for enhancing the reliability and security of modern electrical systems.