FDIFormer Protocol Aware Transformer Learning for False Data Injection Attack Detection in Smart Grid Networks

Jul 16, 2026

Upload by Miles

Smart grids rely on communications networks and IEC 61850-based intelligent electronic devices, yet tight integration increases exposure to cyberattacks such as message tampering and denial of service. A key threat is False Data Injection (FDI), where attackers delete, modify, or add packets to manipulate messages. Detecting FDI in IEC 61850 GOOSE traffic is difficult because malicious packets can closely mimic legitimate protocol behavior. FDIFormer addresses this with a feature-engineering-free framework that encodes GOOSE packet sequences as structured text windows and fine-tunes Transformer models to learn attack patterns directly, evaluated on the QUT-ZSS-2023-GOOSE dataset.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages15

Reading Time38 min

Introduction

Background: Smart grids and IEC 61850

GOOSE protocol and False Data Injection threats

Motivation and challenges of existing detection methods

FDIFormer:Protocol-Aware Transformer Learning for False Data Injection Attack Detection in Smart Grid Networks Sandara Sathsarani Wijethunga, Muneeb Ul Hassan, Member, IEEE, and Nasrin Sohrabi, Member, IEEE arXiv :2607 .062 13v 1 [ cs .CR] 7 Jul 2026 Abstract—Smart grids use communication networks and intelligent electronic devices for reliable and automated operation of power systems. As these systems become increasingly interconnected, they are also becoming more exposed to cyberattacks such as message tampering, false command injection, and denialof-service attacks. One particularly concerning threat is False Data Injection (FDI), where attackers manipulate communication messages by deleting, modifying, or adding packets. This is especially crucial in IEC 61850-based substations, where Generic Object-Oriented Substation Event (GOOSE) messages are used for delivering time-critical protection and control information between devices. Detecting FDI attacks in IEC 61850 GOOSE traffic remains challenging because malicious packets can closely resemble legitimate communication, making them difficult to distinguish from normal operational behaviour. Furthermore, many existing detection methods depend heavily on manually engineered protocol features, which require extensive domain knowledge and may not generalise well across different smart grid environments. This paper proposes FDIFormer, a featureengineering-free framework for FDI attack detection using structured textual representations of GOOSE packet sequences and fine-tuned pre-trained Transformer models. The proposed framework converts protocol packets into structured text windows that capture communication behaviour and enables Transformer models to learn attack-related patterns directly from the data. The framework is evaluated using the QUT-ZSS-2023-GOOSE dataset under a scenario-level three-fold cross-validation strategy. Experimental results show that GraphCodeBERT achieves an MCC of 0.595 ± 0.122, achieving performance comparable to the strongest feature-engineered baseline, XGBoost (MCC = 0.604 ± 0.121), while improving MCC by 0.133 compared with the TF-IDF baselines. These findings demonstrate that pre-trained Transformer representations can provide an effective technique for FDI attack detection in IEC 61850 GOOSE communication without relying on manually engineered protocol features. Index Terms—IEC 61850, GOOSE protocol, False Data Injection, Transformer models, pre-trained language models, smart grid cybersecurity, intrusion detection, feature-engineering-free detection. I. INTRODUCTION SMART Grids have become an important part of modern power systems because they improve efficiency, reliability, and real-time monitoring of electricity networks [19], [20] . With the switch of substations to digital architectures, standardised communication protocols have become essential for coordinating the growing number of interconnected devices S. S. Wijethunga, M. U. Hassan, and N. Sohrabi are with the School of Information Technology, Deakin University, Australia (email: [s224740132@deakin.edu.au](s224740132@deakin.edu.au); [muneeb.ulhassan@deakin.edu.au](muneeb.ulhassan@deakin.edu.au); nas[rin.sohrabi@deakin.edu.au](rin.sohrabi@deakin.edu.au)) . [36] . The IEC 61850 standard has been widely used in modern substations to support communication between Intelligent Electronic Devices (IEDs), providing a common framework for interoperability and automation [21], [22] . The Generic Object-Oriented Substation Event (GOOSE) protocol is one of the communication services defined by IEC 61850, which is especially important for fast, eventdriven exchange of protection and control information between substation devices [36] . GOOSE messages are developed for speed and reliable communication over shared Ethernet networks and are time-sensitive, not designed for security and thus subject to being hacked [24] . IEC 61850 improves operational performance, but it als

FAQs

What is a False Data Injection (FDI) attack in smart grid communications?

An FDI attack manipulates communication messages by deleting, modifying, or adding packets so that power system devices receive misleading data. In IEC 61850 contexts, this can mislead protection relays or controllers.

Why is detecting FDI attacks in IEC 61850 GOOSE traffic challenging?

Malicious GOOSE messages can resemble legitimate operational traffic, making them difficult to distinguish. Additionally, many existing methods depend on manually engineered protocol features that may not generalize well.

How does FDIFormer detect FDI attacks without feature engineering?

FDIFormer converts GOOSE packet sequences into structured textual representations (text windows) and fine-tunes pre-trained Transformer models to learn attack-related patterns directly from the data.

Jul 16, 2026

Upload by Miles