Federated Deep Packet Inspection for Intrusion Detection in Interconnected Power Grids

Abstract

The integration of Information Technology (IT) - Operational Technology (OT) communication networks has enhanced automation and efficiency in power systems but has also expanded their attack surface. Advanced Persistent Threats (APTs) can coordinate cyber attacks across multiple power grid operators. Machine Learning (ML)-based Deep Packet Inspection (DPI) methods have been used to detect intrusions in OT networks. However, centralized training of ML-based DPI models using data from multiple power grid operators can raise data-sharing concerns while isolated local models fail to capture cross-border attack patterns. This paper proposes a Federated Deep Packet Inspection (FedGridDPI) method to analyze OT communication traffic from digital substations and control centers of various power grid operators and detect wide-area intrusions in interconnected power systems. It integrates principal component analysis with a gated recurrent unit classifier and employs federated averaging to aggregate distributed DPI models for collaborative intrusion detection. Experimental results demonstrate that FedGridDPI achieves 97.5% detection accuracy using OT network traffic from IEEE 39-bus simulations and public OT datasets, enabling privacy-preserving, large-scale cyber attacks detection.