Security Monitoring of IEC 61850 Substations Using IEC 62351-7 Network and System Management1

Network and system management (NSM) plays an important role in ensuring end-to-end security of power systems. As defined in IEC 62351-7, NSM provides system security awareness through the collection of a large amount of data in order to monitor the power grid operational environments. In this paper, we follow the IEC 62351-7 guidelines to develop an NSM platform for IEC 61850 substations. Then, on top of the developed platform, we build a hybrid, deep learning and rule-based, anomaly detection system. Furthermore, considering IEC 61850 protocols, we develop a list of potential cyber attacks on the substation that are likely to impact the power grid availability. The effectiveness of the proposed anomaly detection system against the identified attacks is confirmed by testing it on an IEEE 8-Bus system in the presence of NSM using a smart grid testbed.1The research reported in this article has been supported by the NSERC/Hydro-Qubec Thales Senior Industrial Research Chair in Smart Grid Security