Stacking Ensemble Learning Model for Intrusion Detection in Electrical Substation
DOI:
https://doi.org/10.29207/resti.v9i5.6502Keywords:
electrical substations, intrusion detection system, machine learning, stacking ensemble learningAbstract
Electrical substations are crucial infrastructure in power transmission and distribution but are increasingly vulnerable to cyber threats. However, existing intrusion detection systems (IDS) face challenges such as high false positive rates, limited adaptability to emerging attack patterns, and imbalanced detection across different intrusion types. This study proposes a Stacking Ensemble Learning model to enhance intrusion detection accuracy in electrical substations. The proposed model integrates Logistic Regression (LR), Support Vector Machine (SVM), K-Nearest Neighbors (KNN), and XGBoost (XGB) as base models with XGB acting as the meta-model. A real-world electrical substation IEC 60870-5-104 network traffic dataset comprising 319,949 instances with multiple attacks, such as DoS, Port Scan, NTP DdoS, IEC 104 Starvation, Fuzzy Attack, Flood Attack, and MITM, was used for this study. The results showed that the stacking model had the best accuracy (0.99990), precision (0.99990), recall (0.99990), and F1-score (0.99990), beating out the base, Bagging, and Boosting models. T-test results further confirmed statistical significance, with p-values of 0.00428 (LR), 0.04237 (SVM), 0.00000 (XGB), 0.00057 (KNN), 0.00549 (Boosting), and 0.00000 (Bagging) reinforcing the superiority of the Stacking Ensemble Learning approach. These findings highlight the effectiveness of Stacking Ensemble Learning in enhancing the detection accuracy of IDS for electrical substations and outperforming traditional models and other ensemble learning methods by minimizing false positives and false negatives.
Downloads
References
M. L. De Klerk and A. K. Saha, “A Review of the Methods Used to Model Traffic Flow in a Substation Communication Network,” IEEE Access, vol. 8, pp. 204545–204562, 2020, doi: 10.1109/ACCESS.2020.3037143.
M. F. Elrawy, L. Hadjidemetriou, C. Laoudias, and M. K. Michael, “Light-weight and Robust Network Intrusion Detection for Cyber-attacks in Digital Substations,” in 2021 IEEE PES Innovative Smart Grid Technologies - Asia (ISGT Asia), IEEE, Dec. 2021, pp. 1–5. doi: 10.1109/ISGTAsia49270.2021.9715626.
M. A. Aftab, S. M. S. Hussain, I. Ali, and T. S. Ustun, “IEC 61850 based substation automation system: A survey,” International Journal of Electrical Power & Energy Systems, vol. 120, p. 106008, Sep. 2020, doi: 10.1016/J.IJEPES.2020.106008.
P. Wu, D. Wang, and J. Wu, “IEC60870-5-104 Protocol Security Analysis and Automated Simulation Attack System,” in 2024 International Conference on Electronics and Devices, Computational Science (ICEDCS), IEEE, Sep. 2024, pp. 336–342. doi: 10.1109/ICEDCS64328.2024.00066.
X. Wu, G. Qu, H. Jin, and L. Zhang, “Digital Substation Security Monitoring Network Intrusion Detection Based on Deep Learning,” in 2023 3rd International Conference on Energy, Power and Electrical Engineering (EPEE), IEEE, Sep. 2023, pp. 1091–1094. doi: 10.1109/EPEE59859.2023.10352047.
R. Zhao et al., “A Novel Intrusion Detection Method Based on Lightweight Neural Network for Internet of Things,” IEEE Internet Things J, vol. 9, no. 12, pp. 9960–9972, Jun. 2022, doi: 10.1109/JIOT.2021.3119055.
U. Ahmed et al., “Signature-based intrusion detection using machine learning and deep learning approaches empowered with fuzzy clustering,” Scientific Reports 2025 15:1, vol. 15, no. 1, pp. 1–33, Jan. 2025, doi: 10.1038/s41598-025-85866-7.
M. A. Umer, K. N. Junejo, M. T. Jilani, and A. P. Mathur, “Machine learning for intrusion detection in industrial control systems: Applications, challenges, and recommendations,” International Journal of Critical Infrastructure Protection, vol. 38, p. 100516, Sep. 2022, doi: 10.1016/J.IJCIP.2022.100516.
A. Vikram and Mohana, “Anomaly detection in Network Traffic Using Unsupervised Machine learning Approach,” in 2020 5th International Conference on Communication and Electronics Systems (ICCES), IEEE, Jun. 2020, pp. 476–479. doi: 10.1109/ICCES48766.2020.9137987.
S. A. Bakhsh, M. A. Khan, F. Ahmed, M. S. Alshehri, H. Ali, and J. Ahmad, “Enhancing IoT network security through deep learning-powered Intrusion Detection System,” Internet of Things, vol. 24, p. 100936, Dec. 2023, doi: 10.1016/j.iot.2023.100936.
A. Verma and V. Ranga, “Machine Learning Based Intrusion Detection Systems for IoT Applications,” Wirel Pers Commun, vol. 111, no. 4, pp. 2287–2310, Apr. 2020, doi: 10.1007/s11277-019-06986-8.
G. ZHU, H. YUAN, Y. ZHUANG, Y. GUO, X. ZHANG, and S. QIU, “Research on network intrusion detection method of power system based on random forest algorithm,” in 2021 13th International Conference on Measuring Technology and Mechatronics Automation (ICMTMA), IEEE, Jan. 2021, pp. 374–379. doi: 10.1109/ICMTMA52658.2021.00087.
K. Shanthi and R. Maruthi, “Machine Learning Approach for Anomaly-Based Intrusion Detection Systems Using Isolation Forest Model and Support Vector Machine,” in 2023 5th International Conference on Inventive Research in Computing Applications (ICIRCA), IEEE, Aug. 2023, pp. 136–139. doi: 10.1109/ICIRCA57980.2023.10220620.
V. Sharma and D. J. Shah, “A Novel Approach to Intrusion Detection Systems Using Hybrid Machine Learning Techniques,” in 2024 International Conference on Artificial Intelligence and Quantum Computation-Based Sensor Application (ICAIQSA), IEEE, Dec. 2024, pp. 1–6. doi: 10.1109/ICAIQSA64000.2024.10882184.
L. Yang and A. Shami, “IDS-ML: An open source code for Intrusion Detection System development using Machine Learning,” Software Impacts, vol. 14, p. 100446, Dec. 2022, doi: 10.1016/j.simpa.2022.100446.
E. Retnoningsih and R. Pramudita, “Mengenal Machine Learning Dengan Teknik Supervised Dan Unsupervised Learning Menggunakan Python,” BINA INSANI ICT JOURNAL, vol. 7, no. 2, p. 156, Dec. 2020, doi: 10.51211/biict.v7i2.1422.
R. Xu, G. Wu, W. Wang, X. Gao, A. He, and Z. Zhang, “Applying self-supervised learning to network intrusion detection for network flows with graph neural network,” Computer Networks, vol. 248, p. 110495, Jun. 2024, doi: 10.1016/j.comnet.2024.110495.
Ajeng Arifa Chantika Rindu, Ria Astriratma, and Ati Zaidiah, “K-Means Algorithm Implementation for Project Health Clustering,” Jurnal RESTI (Rekayasa Sistem dan Teknologi Informasi), vol. 7, no. 5, pp. 1064–1076, Sep. 2023, doi: 10.29207/resti.v7i5.5181.
Md. A. Talukder et al., “Machine learning-based network intrusion detection for big and imbalanced data using oversampling, stacking feature embedding and feature extraction,” J Big Data, vol. 11, no. 1, p. 33, Feb. 2024, doi: 10.1186/s40537-024-00886-w.
X. Du and W. Zhao, “Risky lane-changing behavior recognition based on stacking ensemble learning on snowy and icy surfaces,” Sci Rep, vol. 14, no. 1, p. 19257, Aug. 2024, doi: 10.1038/s41598-024-69642-7.
U. Ahmed et al., “Explainable AI-based innovative hybrid ensemble model for intrusion detection,” Journal of Cloud Computing, vol. 13, no. 1, p. 150, Oct. 2024, doi: 10.1186/s13677-024-00712-x.
E. D. Gutiérrez Mlot, J. Saldana, R. J. Rodríguez, I. Kotsiuba, and C. Gañán, “A dataset to train intrusion detection systems based on machine learning models for electrical substations,” Data Brief, vol. 57, p. 111153, Dec. 2024, doi: 10.1016/J.DIB.2024.111153.
A. Gumilar, S. S. Prasetiyowati, and Y. Sibaroni, “Performance Analysis of Hybrid Machine Learning Methods on Imbalanced Data (Rainfall Classification),” Jurnal RESTI (Rekayasa Sistem dan Teknologi Informasi), vol. 6, no. 3, pp. 481–490, Jul. 2022, doi: 10.29207/resti.v6i3.4142.
Y. Prihantono and Kalamullah Ramli, “Model-Based Feature Selection for Developing Network Attack Detection and Alerting System,” Jurnal RESTI (Rekayasa Sistem dan Teknologi Informasi), vol. 6, no. 2, pp. 322–329, Apr. 2022, doi: 10.29207/resti.v6i2.3989.
R. Shaikh, M. Rafi, N. A. Mahoto, A. Sulaiman, and A. Shaikh, “A filter-based feature selection approach in multilabel classification,” Mach Learn Sci Technol, vol. 4, no. 4, p. 045018, Dec. 2023, doi: 10.1088/2632-2153/ad035d.
Nia Mauliza, Aisha Shakila Iedwan, Yoga Pristyanto, Anggit Dwi Hartanto, and Arif Nur Rohman, “The Effect of Resampling Techniques on Model Performance Classification of Maternal Health Risks,” Jurnal RESTI (Rekayasa Sistem dan Teknologi Informasi), vol. 8, no. 4, pp. 496–505, Aug. 2024, doi: 10.29207/resti.v8i4.5934.
P. Ghose, K. Oliullah, M. K. Mahbub, M. Biswas, K. N. Uddin, and H. M. Jamil, “Explainable AI assisted heart disease diagnosis through effective feature engineering and stacked ensemble learning,” Expert Syst Appl, vol. 265, p. 125928, Mar. 2025, doi: 10.1016/j.eswa.2024.125928.
B. Sunarko et al., “Penerapan Stacking Ensemble Learning untuk Klasifikasi Efek Kesehatan Akibat Pencemaran Udara,” Edu Komputika Journal, vol. 10, no. 1, pp. 55–63, Sep. 2023, doi: 10.15294/edukomputika.v10i1.72080.
R. Kalule, H. A. Abderrahmane, W. Alameri, and M. Sassi, “Stacked ensemble machine learning for porosity and absolute permeability prediction of carbonate rock plugs,” Sci Rep, vol. 13, no. 1, p. 9855, Jun. 2023, doi: 10.1038/s41598-023-36096-2.
D. M. A. S. Elkahwagy, C. J. Kiriacos, and M. Mansour, “Logistic regression and other statistical tools in diagnostic biomarker studies,” Clinical and Translational Oncology, vol. 26, no. 9, pp. 2172–2180, Mar. 2024, doi: 10.1007/s12094-024-03413-8.
W. Zhao and Z. Zhao, “Providing a hybrid approach to increase the accuracy of intrusion detection systems in computer networks,” Journal of Engineering and Applied Science, vol. 71, no. 1, p. 123, Dec. 2024, doi: 10.1186/s44147-024-00404-y.
Agus Supriyanto, R. Rizal Isnanto, and Oky Dwi Nurhayati, “Klasifikasi Penyakit Daun Kopi Robusta Menggunakan Metode SVM dengan Ekstraksi Ciri GLCM,” Jurnal Nasional Teknik Elektro dan Teknologi Informasi, vol. 12, no. 4, pp. 241–248, Nov. 2023, doi: 10.22146/jnteti.v12i4.8044.
Wikky Fawwaz Al Maki, Khaidir Mauladan, and Indra Bayu Muktyas, “Date Fruit Classification using K-Nearest Neighbor with Principal Component Analysis and Binary Particle Swarm Optimization,” Jurnal RESTI (Rekayasa Sistem dan Teknologi Informasi), vol. 7, no. 6, pp. 1456–1463, Dec. 2023, doi: 10.29207/resti.v7i6.4839.
S. K. Kiangala and Z. Wang, “An effective adaptive customization framework for small manufacturing plants using extreme gradient boosting-XGBoost and random forest ensemble learning algorithms in an Industry 4.0 environment,” Machine Learning with Applications, vol. 4, p. 100024, Jun. 2021, doi: 10.1016/j.mlwa.2021.100024.
Erfian Junianto, Mila Puspitasari, Salman Ilyas Zakaria, Toni Arifin, and Ignatius Wiseto Prasetyo Agung, “Klasifikasi Emosi pada Teks Berbahasa Inggris Menggunakan Pendekatan Ensemble Bagging,” Jurnal Nasional Teknik Elektro dan Teknologi Informasi, vol. 13, no. 4, pp. 272–281, Nov. 2024, doi: 10.22146/jnteti.v13i4.14440.
K. Soman, C. Kokate, A. Mohite, A. Vispute, O. More, and Prof. Z. K. Mundargi, “Statistical Tests for Comparing Machine Learning Algorithms,” Int J Res Appl Sci Eng Technol, vol. 10, no. 12, pp. 628–633, Dec. 2022, doi: 10.22214/ijraset.2022.47955.
Downloads
Published
Issue
Section
License
Copyright in each article belongs to the author
- The author acknowledges that the RESTI Journal (System Engineering and Information Technology) is the first publisher to publish with a license Creative Commons Attribution 4.0 International License.
- Authors can enter writing separately, arrange the non-exclusive distribution of manuscripts that have been published in this journal into other versions (eg sent to the author's institutional repository, publication in a book, etc.), by acknowledging that the manuscript has been published for the first time in the RESTI (Rekayasa Sistem dan Teknologi Informasi) journal ;
