Detecting Zero-Day Attacks in IEC-61850 based Digital Substations via In-Context Learning

The occurrences of cyber attacks, with novel attack techniques, on the electrical power grids have been increasing every year. In this thesis, we address the critical challenge of detecting novel/zero-day attacks in digital substations that employ the IEC-61850 communication protocol. While many heuristic and ML-based methods have been proposed for attack detection in IEC-61850 digital substations, generalization to novel or zero-day attacks remains challenging. We propose an approach that leverages the in-context learning (ICL) capability of the transformer architecture, the fundamental building block of large language models. The ICL approach enables the model to detect zero-day attacks and learn from a few examples of that attack without explicit retraining. Our experiments on the IEC-61850 dataset demonstrate that the proposed method achieves more than 85% detection accuracy on zero-day attacks while the existing state-of-the-art baselines fail. This work paves the way for building more secure and resilient digital substations of the future.

Name thesis:degree_name

Master of Science

Level thesis:degree_level

masters

Discipline thesis:degree_discipline

Electrical Engineering

Department dc:contributor.department

Electrical Engineering

Grantor dc:publisher

Virginia Tech

Year dc:date.issued

2025

Author dc:creator

• Manzoor, Faizan

Chair dc:contributor.committeechair

• Jin, Ming

Committee members dc:contributor.committeemember

• Liu, Chen-Ching
• Viswanath, Bimal

• In-context learning
• IEC-61850
• intrusion detection systems
• zero-day attacks
• GPT-2 transformer

Statement dc:rights

• In Copyright

Licence dc:rights.uri

• http://rightsstatements.org/vocab/InC/1.0/

Language dc:language.iso

en

Dc Identifier Other

vt_gsexam:43657

OAI identifier oai:identifier

oai:vtechworks.lib.vt.edu:10919/134226