Intrusion Detection (IDS) in Substation Networks

What problem it solves

The classic security measures in a substation are preventive: segment the network, put a firewall at the boundary, close ports and control access. All are necessary, but none says what happens inside the network once something has got in. A contractor’s laptop plugged into a free port, a maintenance account used at an unusual hour or an IED receiving a configuration nobody scheduled go unnoticed if nobody watches the traffic.

An intrusion detection system (IDS) does that job. It observes the traffic, interprets it and raises an alert when something departs from what is expected. IEC 62443-3-3, in its continuous monitoring requirement, asks the system to be able to watch its own behavior to detect incidents; IEC 62351-7 provides network monitoring objects specific to the power sector.

Why it works so well in a substation

Office traffic changes all the time: new people, new applications, new destinations on the internet. Substation traffic is almost fixed. The same IEDs publish the same GOOSE messages at the same rate, the gateway polls the same relays and the control center sends controls to the same objects. That repetitive nature is an advantage: once the baseline is learned, anything new stands out.

That is why IDS products for industrial networks work mainly with a baseline and an allow list. During a learning period they record the devices, the conversations and the message types. After that, they alert on anything that was not on the list. On top of that they add signatures of known attacks and protocol-specific rules.

Typical alerts

Not every alert is an attack. Most of them, especially at the start, are legitimate changes nobody recorded. That side effect is useful: the IDS forces the inventory and change control to be kept up to date.

Where the sensor goes

The sensor receives a copy of the traffic from a switch mirror port or a TAP, so it is not in the path of the messages and cannot delay or block them. The usual locations are:

• The main station bus switch, where MMS traffic, inter-bay GOOSE and management meet.
• The boundary with the wide area network, where the control center’s commands come in.
• The remote access path, to record what was done in each maintenance session.

The process bus deserves a separate decision: its volume of sampled values is very high and repetitive, and watching all of it requires sensors sized for the job. The guide on the process bus shows why that traffic is so heavy.

An IDS does not replace the firewall or segmentation. It works best on a well-designed network, with defined zones and traffic organized by VLAN, as described in the guide on the industrial router and firewall.

Passive detection versus blocking

An intrusion prevention system (IPS) is installed inline and can block traffic it considers malicious. In an office that is reasonable; in a substation, a false positive could block a legitimate trip or control. That is why the practice is to use passive detection on protection and control networks, and to reserve blocking for boundaries where no time-critical messages flow, such as the remote access entry point.

Products and maturity

There are industrial network monitoring platforms with support for power sector protocols, for example from Nozomi Networks, Claroty, Dragos or Cisco (Cyber Vision), and some substation equipment manufacturers offer their own solutions. The brands are named only as examples. When evaluating them, check which protocols they actually decode (not just which ones they recognize), whether they tell reads from controls and configuration uploads, and how their alerts integrate with SCADA and with centralized logging.

What it takes to be useful

• An up-to-date inventory and network diagram. Without them, every alert is an investigation.
• Someone responsible for reviewing alerts. An IDS without follow-up only piles up logs.
• Synchronized time in sensors, IEDs and servers, to correlate events.
• Change control. Each planned intervention is announced, so its traffic is not mistaken for an incident.
• Monitoring of the network itself with SNMPv3 and syslog, so that a switch or link failure is not mistaken for an attack.

One last practical point: the baseline learning period must cover real operation, with switching, control center polling and maintenance tasks. A baseline taken over a quiet weekend later raises alerts for everything that is normal on weekdays.

How we help

Intrusion detection starts from an orderly network: zones, VLANs, documented addresses and controlled access. At Tiza Group we handle the control, protection and communications configuration of high and extra-high voltage substations and industrial plants, and we design the segmentation and monitoring points remotely as part of our communications engineering service. Our remote relay configuration works within that scheme: each session is authorized, logged and visible to your security team. Contact us.

Related guides

• Industrial router and firewall
• IEC 62351: cybersecurity for IEC 61850, IEC 104 and DNP3
• Is remote relay configuration secure?
• Substation communication network
• Traffic storm in the substation network
• IEEE 1686: cybersecurity requirements for IEDs
• Power sector cybersecurity: NERC CIP and Latin America
• Substation communications by voltage level
• Secure remote access to relays and substations

References

• IEC 62443-3-3, Industrial communication networks – Network and system security – System security requirements and security levels (foundational requirement 6, timely response to events).
• IEC 62351-7:2025, Network and System Management (NSM) data object models.
• IEC TR 61850-90-4:2020, Network engineering guidelines (refers security to IEC 62351 and IEC 62443).
• NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security.

Frequently asked questions