Real-Time IDS for Digital Substations: From Lab to Field Deployment

This paper presents an end-to-end intrusion detection framework for digital substations, spanning dataset construction, model development, embedded deployment, and field-oriented validation. A hybrid dataset is leveraged, combining traffic traces collected from operational substations with laboratory-generated traces designed to emulate cyberattack behaviors that cannot be safely reproduced in critical infrastructure environments. On this basis, a machine learning-based intrusion detection system (IDS) is trained to identify anomalous IEC 61850 communications, with particular emphasis on GOOSE messaging and substation-specific traffic dynamics. To bridge the gap between offline analysis and operational use, the IDS is integrated into SecureBox, an embedded cybersecurity device engineered…