Anomaly detection in digital substations using semi-supervised learning

Abstract

The integration of Information and Communication Technology (ICT) into Operational Technology (OT) environments in modern substations has heightened cybersecurity risks. Effective Intrusion Detection Systems (IDS) are essential, yet current supervised learning methods struggle due to the scarcity and unreliability of labeled attack data. To address this, we propose a Semi-Supervised Anomaly Detection (SSAD) approach that leverages partially labeled datasets, where normal samples are labeled but anomalies are sparse or unlabeled. SSAD provides flexibility and efficiency in real-time detection, making it particularly suitable for digital substations and IEC104 network traffic. Our method enables reliable intrusion detection without requiring extensive labeled anomaly data, offering a practical solution to enhance both security and resilience.