Abnormal Message Logic & Sequence Detection for Process Layer Network in Digital Substation

Logic target attack and sequence target attack are two types of sophisticated and vicious cyber-attacks, which have not been paid a necessary attention in most critical part, i.e., the process layer network in digital substation. The relationships of such two types attack are explored, and networked structure of an intrusion detection & prevention system for the process layer network is proposed. A whitelist-based detection scheme is also proposed; firstly, the corresponding packets are described from the packet transfer path and the circuit breaker action packet; then, the different detection methods are used to check the packets; the simulation test results and verification show that the proposed method can detect an abnormal transmission path message and a replay attack with inserted circuit breaker action packet.