<![CDATA[Electrical substations are crucial infrastructure in power transmission and distribution but are increasingly vulnerable to cyber threats. However, existing intrusion detection systems (IDS) face challenges such as high false positive rates, limited adaptability to emerging attack patterns, and imbalanced detection across different intrusion types. This study proposes a Stacking Ensemble Learning model to enhance intrusion detection accuracy in electrical substations. The proposed model integrates Logistic Regression (LR), Support Vector Machine (SVM), K-Nearest Neighbors (KNN), and XGBoost (XGB) as base models with XGB acting as the meta-model. A real-world electrical substation IEC 60870-5-104 network traffic dataset comprising 319,949 instances with multiple attacks, such as DoS, Port Scan, NTP DdoS, IEC 104 Starvation, Fuzzy Attack, Flood Attack, and MITM, was used for this study. The results showed that the stacking model had the best accuracy (0.99990), precision (0.99990), recall (0.99990), and F1-score (0.99990), beating out the base, Bagging, and Boosting models. T-test results further confirmed statistical significance, with p-values of 0.00428 (LR), 0.04237 (SVM), 0.00000 (XGB), 0.00057 (KNN), 0.00549 (Boosting), and 0.00000 (Bagging) reinforcing the superiority of the Stacking Ensemble Learning approach. These findings highlight the effectiveness of Stacking Ensemble Learning in enhancing the detection accuracy of IDS for electrical substations and outperforming traditional models and other ensemble learning methods by minimizing false positives and false negatives.]]>
Copyrights © 2025
