## 4 Substation
### Threats and Security Concerns in IEC61850 Power Systems  
The vulnerability of the power system automation system is different from that of the computer internet due to narrow bandwidth and throughput restrictions leading to more overheads because of digital signatures and key exchanges. Moreover, communication devices such as controllers have miniature memory and processing power, hence, it is challenging to encrypt them [51]. The wide use of the IEC 61850 standard can be mainly attributed to its interoperability, standardized message structures, and swift and effortless connecting abilities via ethernet instead of the traditional hard-wired systems. The fact that it is very easy to connect and access has increased its vulnerability to cyber-attacks. The gains for an attacker to infiltrate the system are major, disrupting the services in the IEC 61850 substation by altering or fabricating the data and information exchanges and also gaining access to confidential data and information. Various types of attacks are carried out on substation communication networks aiming at a specific domain, protocol, or node. In the work by [74; 75], the authors discussed the malicious fault injection attack (FIA) and the false data injection (FDI) that usually targets intelligent electronic devices. This kind of attack is orchestrated by injecting computation errors through invasive or non-invasive techniques. The authors also went further to evaluate the impacts of these attacks on substation security and power grid integrity. In the work by [76], the authors proposed an audit scheme that consists of security metrics that can quantify the security of a certain network. This audit scheme was carried out on the security of the IEC 61850 substation, and it was realized that intrusion attacks are the most common types of attacks on the system. It was, however, concluded that an intrusion detection technique should be employed as a viable option to counter these attacks. In a typical IEC 61850, each GOOSE message has two parameters, which are the status number (stNum) and the sequence number (sqNum), and for each GOOSE message published, the sqNum value is increased by one while the stNum is updated according to the new event. The work by [77] identified three types of attacks on GOOSE messages, which is commonly known as GOOSE poisoning. One of those types of attacks is the high-status number attack in which malicious GOOSE messages with high stNum are sent by the hacker. Unknowingly to the subscriber, these malicious messages are processed while the legitimate GOOSE messages with stNum equal to or less than those of the malicious messages are discarded. Another of these attacks is the high-rate flooding attack in which multiple malicious GOOSE messages are delivered as multicast messages while stNum increases. This, however, results in the subscriber being expectant of a very high value of stNum for the incoming GOOSE message. The last of these attacks is the semantic attack. This type of attack is carried out in two stages. The first stage is where the attacker monitors the network traffic and decides on the rate of status change, while the second stage is where the attacker multicasts malicious messages with different rates. The purpose of these malicious messages is to block subscribers from processing legitimate GOOSE messages. Cyber intrusion attacks on IEC 61850 GOOSE messages and SMV messages have been detailed in [78]. In this kind of attack, the intruders tend to alter GOOSE messages to trip circuit breakers in substations. If an intruder is armed with an SMV message, the intruder can fabricate values that can control centers, which can eventually lead to incorrect conclusions and operational decisions. To prevent intruders from gaining access to the substation automation controls, the authors [78] proposed an Integrated Anomaly Detection System (IADS). In the same vein, another intrusion detection system was also proposed by [76]. It operates based on data collected from simulated attacks on intelligent electronic devices.