Machine Learning Expert Framework for Cyberattack Detection in the International Electrotechnical Commission 61850 Substations

Abstract

Digital communication expansion in electrical substations introduces significant cybersecurity vulnerabilities into critical power system protection functions. This study presents an intelligent expert decision-support framework utilizing conventional machine learning algorithms and stacking ensembles to classify physical power faults alongside distinct cyberattack vectors within International Electrotechnical Commission (IEC) 61850 - based digital substations. Evaluating a publicly available 52-feature digital substation dataset, an initial integrity assessment revealed event overlaps between official splits, prompting the implementation of stratified five-fold cross-validation for robust model validation. Gradient Boosting demonstrated superior diagnostic performance, achieving 87.20% accuracy, a 0.791 macro averaged F1-score, and an 0.809 Matthews correlation coefficient. Feature ablation established that protocol-level and consistency features yield higher predictive value than raw electrical measurements. While effective at identifying physical faults and masquerade attacks, reduced recall on replay and injection threats highlights specific diagnostic limitations. Ultimately, this research provides an actionable applied framework emphasizing data integrity and class wise evaluation for critical infrastructure cybersecurity systems.