CP Fusion based Abnormal Traffic Dedection for Process Layer Network in Digital Substation

When abormalities, including equipment failure and/or cyber attacks, occur in the substation, it is essential to specify their difference in performance, e.g., process layer of digital substation will encounter stochastic messages and burst messages in normal operation, abnormal traffic caused by equipment fault, or denial-of-service (DoS) attacks by virus intrusion. In this reason, a novel cyber physical fusion based abnormal traffic detection approach has been proposed, a difference-sequence-variance based abnormal message traffic detection method and flowchart is proposed, including a new substation traffic anomaly membership function and its parameter estimation method. The simulation verification of the T1-1 type substation network is done by OPNET, which prove that the random and burst GOOSE messages as well as DoS attacks in the layer can be identified by proposed method.