Tail-calibrated mixture of experts for ultra-low false-alarm intrusion detection in IEC 61850 communications

IEC 61850 communications in digital substations require intrusion detection methods that can operate under very low false-alarm budgets while remaining sensitive to both availability disruption and integrity manipulation. This paper presents a tail-calibrated mixture of experts detector for ultra-low false-alarm intrusion detection in IEC 61850 traffic. The method integrates three complementary evidence streams: an availability-focused autoencoder that models timing, rate, volume, and protocol composition regularities; an integrity-focused autoencoder that models semantic, value, and counter related consistency in GOOSE and SV derived features; and a CUSUM-based timing change detector for persistent rate and inter-arrival time deviations. Expert scores are learned and standardized using baseline-only data, converted into calibrated right tail probabilities using empirical or EVT smoothed survival estimates, and fused using a Fisher-style evidence combination statistic. The fused score is thresholded on held-out baseline windows to report detection at fixed false positive rates of 10⁻⁴ and 10⁻³ . Evaluation on SGSim-generated IEC 61850 traces shows that the proposed method matches the strongest timing-centric detectors at FPR=10⁻⁴ and improves overall detection at FPR=10⁻³ , while providing explainable diagnostics through expert contribution decomposition and feature group residual attributions. The results demonstrate that tail-calibrated expert fusion is a practical and interpretable approach for IEC 61850 anomaly detection under stringent false-alarm constraints, while also highlighting the need for further validation on real substations, heterogeneous devices, benign disturbances, and additional attack classes.