Strategy Phasing of Cyber Attacks on Digital Substations

2026-07-30

AI Summary

This work addresses the limitations of existing intrusion detection systems in comprehending the multi-stage tactics of cyberattacks targeting digital substations, particularly their lack of global contextual awareness. By leveraging the MITRE ATT&CK framework, the authors construct an attack phase model and, for the first time, integrate Hidden Markov Models (HMMs) with intrusion detection logs to enable dynamic inference of the entire IEC 61850 cyberattack lifecycle. The proposed approach can infer both the current and subsequent attack stages in real time and reconstruct complete attack trajectories retrospectively. Experimental results demonstrate that the method exhibits strong robustness under varying levels of IDS observability and even in the presence of missing log data, significantly enhancing situational understanding of attacks and supporting more effective response strategies.

Abstract

Digital substations that comply with IEC 61850 have improved the operational efficiency of modern power systems. However, adversaries can abuse IEC 61850 communication to manipulate circuit breaker operations in substations, which can result in severe system impacts. These cyber attacks are crafted based on broader multi-phase strategies. The existing intrusion detection systems (IDSs) often flag only isolated symptoms. Thus, there is a lack of context in the attack phase to support the deployment of mitigation measures. This paper proposes Substation Cyber Attack Strategy Phasing (SubCASP), a Hidden Markov Model(HMM)- based method that fuses IDS data logs to infer the current attack phase, next attack phase, and retrospective attack path. The attack phases are derived from an ATT&CK-based threat modeling. The SubCASP model is trained and evaluated on a reproducible attack-graph dataset. Test results are presented to demonstrate the robustness of SubCASP for various IDS observability levels and missing IDS data logs scenarios.

Problem

• cyber attacks
• digital substations
• attack phasing
• intrusion detection
• IEC 61850

Innovation

• Hidden Markov Model
• IEC 61850
• ATT&CK
• Intrusion Detection System
• Attack Phasing