Figure 1.
IEC 61850-based intelligent substation communication architecture illustrating the interaction between IEDs, SCADA infrastructure, and FDIA attack surfaces through vulnerable GOOSE/MMS communication channels
Table 1.
Simulation parameters
| Parameter | Value |
|---|---|
| System | IEEE 118-bus |
| Library | Pandapower v2.13 |
| Total sample | 2000 |
| Normal / FDIA | 1600 / 400 (80% / 20%) |
| Test set | 500 (400 normal + 100 FDIA) |
| Feature size | 12 features per bus |
| Training / Test split | 75% / 25% |
| Target bus | Bus 69 |
Table 2.
Comparison of FDIA detection performances for a test set of 500 samples
| Metric | LSTM | Isolation Forest | One-Class SVM |
|---|---|---|---|
| Accuracy | 98.60% | 96.20% | 94.80% |
| [97.14%–99.32%] | [94.14%–97.55%] | [92.49%–96.43%] | |
| Recall | 97.00% | 93.00% | 90.00% |
| [91.55%–98.97%] | [86.25%–96.57%] | [82.56%–94.48%] | |
| Precision | 96.04% | 88.57% | 84.91% |
| [90.26%–98.45%] | [81.08%–93.34%] | [76.88%–90.49%] | |
| F1-Score | 0.965 | 0.907 | 0.874 |
| [0.949–0.981] | [0.882–0.933] | [0.845–0.903] | |
| AUC-ROC | 0.987 | 0.965 | 0.942 |
| [0.971–1.000] | [0.940–0.990] | [0.910–0.974] | |
| False Positive Rate | 1.0% | 3.0% | 4.0% |
| Training Time (s) | 42.3 | 0.8 | 4.2 |
| 95% Recall Benchmark | ✓ PASSES | ✗ FAILS | ✗ FAILS |
Figure 2.
Temporal variations in voltage, current, and active power measurements at Bus 69 under normal operating conditions and FDIA attack scenarios, where the shaded red region indicates the active attack interval
Figure 3.
Receiver Operating Characteristic (ROC) curves comparing the FDIA detection performance of LSTM, Isolation Forest, and One-Class SVM models on the IEEE 118-bus dataset
Figure 4.
Confusion matrices obtained from the evaluation of LSTM, Isolation Forest, and One-Class SVM models on the 500-sample test dataset containing 100 FDIA instances and 400 normal operating samples
Table 3.
Key Confusion Matrix Terms for the Three Evaluated Models
| Metric | LSTM | Isolation Forest | One-Class SVM |
|---|---|---|---|
| TP (True Positive) | 97 | 93 | 90 |
| FN (False Negative) | 3 | 7 | 10 |
| TN (True Negative) | 396 | 388 | 384 |
| FP (False Positive) | 4 | 12 | 16 |
Figure 5.
Comparative performance analysis of the evaluated FDIA detection models using Accuracy, Recall, Precision, F1-score, and AUC-ROC metrics on the IEEE 118-bus test system
Table 4.
Recall Comparison by Attack Type
| Attack Scenario | LSTM | Isolation Forest | One-Class SVM |
|---|---|---|---|
| Scenario A (Gradual Drift) | 96.8% | 89.4% | 83.2% |
| Scenario B (Sudden Injection) | 98.9% | 97.1% | 94.6% |
| Scenario C (Coordinated Corruption) | 97.4% | 91.3% | 87.0% |
| Scenario D (Low Magnitude) | 95.6% | 85.7% | 81.9% |
Table 5.
McNemar Test Results