Enhancing Spoofing Attack Detection in GOOSE Protocol for Digital Substations: A Hybrid Approach Using Feature Selection, Machine Learning, and Deep Learning Models

This thesis investigates cybersecurity vulnerabilities in digital substations, focusing on spoofing attacks on GOOSE communication messages. GOOSE is a protocol that rapidly sends critical control signals between substation devices. The research proposes deep learning–based anomaly detection using DNN, LSTM, and autoencoder models trained on multimodal datasets combining GOOSE attributes and electrical measurements. Experiments demonstrate high detection accuracy, showing the models’ ability to identify subtle, dynamic attack patterns in real time. The integrated approach offers a scalable and robust defense mechanism for power grid infrastructure and forms a foundation for future research toward real-time threat mitigation in digital substations.