What question did this study set out to answer?

This research aims to develop an effective intrusion detection and automated response framework for masquerade attacks on the IEC 61850 GOOSE protocol.

July 19, 2026Open Access

GOOSEIDRS: Intrusion Detection and Automated Response for IEC61850 GOOSE Masquerade Attacks

HAHermenegildo da Conceição Alberto GSGustavo SanchezKarlsruhe Institute of Technology JDJean Marie Dembel

Key Points

This research aims to develop an effective intrusion detection and automated response framework for masquerade attacks on the IEC 61850 GOOSE protocol.
Developed GOOSEIDRS framework incorporating intrusion detection and response mechanisms.
Engineered a feature set focused on state and sequence numbers with timing context for accurate detection.
Employed LightGBM algorithm for real-time operation with a two-threshold warning and attack logic.
Achieved over 99% accuracy, precision, recall, and F1-score in detecting attacks.
Successfully triggered protocol-compliant corrective GOOSE responses during live hardware-in-the-loop experiments.
Effectively evaluated against state-dominant masquerading attacks ensuring robustness.

Abstract

Advanced cyber-attacks on smart grids expose limitations of conventional defenses, particularly for detecting protocol-compliant masquerading and supporting timely response. This paper presents GOOSEIDRS, a reproducible intrusion detection and response framework for the IEC 61850 GOOSE protocol. To support reproducible training and evaluation, we use a protocol-aware augmentation pipeline that extends limited Generic Object Oriented Substation Event (GOOSE) captures into long-duration masquerading traces, while Explainable Artificial Intelligence (XAI) supports decision auditing. We engineer a compact feature set centered on State Number (stNum)/Sequence Number (sqNum) semantics with timing context (inter-arrival time, rolling statistics, and violation indicators). Our LightGBM-based IDS operates online with a two-threshold warning/attack logic, achieves over 99% on accuracy, precision, recall, and F1-score, and triggers protocol-compliant corrective GOOSE responses in live HIL experiments. We evaluate the framework against state-dominant masquerading attacks and release the dataset and artifacts for reproducibility1.

Ask AI

Helpful

Bookmark

View Full Paper