{"id":"https://openalex.org/W4415398192","doi":"https://doi.org/10.1109/smartgridcomm65349.2025.11204562","title":"Domain-Aware Machine Learning for IEC 61850 MMS Intrusion Detection","display_name":"Domain-Aware Machine Learning for IEC 61850 MMS Intrusion Detection","publication_year":2025,"publication_date":"2025-09-29","ids":{"openalex":"https://openalex.org/W4415398192","doi":"https://doi.org/10.1109/smartgridcomm65349.2025.11204562"},"language":null,"primary_location":{"id":"doi:10.1109/smartgridcomm65349.2025.11204562","is_oa":false,"landing_page_url":"https://doi.org/10.1109/smartgridcomm65349.2025.11204562","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SmartGridComm)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5118337117","display_name":"Kishan Baranwal","orcid":null},"institutions":[{"id":"https://openalex.org/I59270414","display_name":"Indian Institute of Science Bangalore","ror":"https://ror.org/04dese585","country_code":"IN","type":"education","lineage":["https://openalex.org/I59270414"]}],"countries":["IN"],"is_corresponding":true,"raw_author_name":"Kishan Baranwal","raw_affiliation_strings":["Indian Institute of Science,Department of Electronic Systems Engineering,Bengaluru,India"],"affiliations":[{"raw_affiliation_string":"Indian Institute of Science,Department of Electronic Systems Engineering,Bengaluru,India","institution_ids":["https://openalex.org/I59270414"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5014763980","display_name":"Haresh Dagale","orcid":null},"institutions":[{"id":"https://openalex.org/I59270414","display_name":"Indian Institute of Science Bangalore","ror":"https://ror.org/04dese585","country_code":"IN","type":"education","lineage":["https://openalex.org/I59270414"]}],"countries":["IN"],"is_corresponding":false,"raw_author_name":"Haresh Dagale","raw_affiliation_strings":["Indian Institute of Science,Department of Electronic Systems Engineering,Bengaluru,India"],"affiliations":[{"raw_affiliation_string":"Indian Institute of Science,Department of Electronic Systems Engineering,Bengaluru,India","institution_ids":["https://openalex.org/I59270414"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5118337117"],"corresponding_institution_ids":["https://openalex.org/I59270414"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.40618638,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":1.0,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":1.0,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10603","display_name":"Smart Grid Energy Management","score":0.9850000143051147,"subfield":{"id":"https://openalex.org/subfields/2208","display_name":"Electrical and Electronic Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13429","display_name":"Electricity Theft Detection Techniques","score":0.9746999740600586,"subfield":{"id":"https://openalex.org/subfields/2208","display_name":"Electrical and Electronic Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.6697999835014343},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5737000107765198},{"id":"https://openalex.org/keywords/probabilistic-logic","display_name":"Probabilistic logic","score":0.5360000133514404},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.5078999996185303},{"id":"https://openalex.org/keywords/feature-engineering","display_name":"Feature engineering","score":0.4880000054836273},{"id":"https://openalex.org/keywords/word2vec","display_name":"Word2vec","score":0.48159998655319214},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.47609999775886536},{"id":"https://openalex.org/keywords/embedding","display_name":"Embedding","score":0.44929999113082886},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.44749999046325684},{"id":"https://openalex.org/keywords/support-vector-machine","display_name":"Support vector machine","score":0.44020000100135803}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8098000288009644},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.6697999835014343},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5770999789237976},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5737000107765198},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5440000295639038},{"id":"https://openalex.org/C49937458","wikidata":"https://www.wikidata.org/wiki/Q2599292","display_name":"Probabilistic logic","level":2,"score":0.5360000133514404},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.5078999996185303},{"id":"https://openalex.org/C2778827112","wikidata":"https://www.wikidata.org/wiki/Q22245680","display_name":"Feature engineering","level":3,"score":0.4880000054836273},{"id":"https://openalex.org/C2776461190","wikidata":"https://www.wikidata.org/wiki/Q22673982","display_name":"Word2vec","level":3,"score":0.48159998655319214},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.47609999775886536},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.44929999113082886},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.44749999046325684},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.44020000100135803},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.42289999127388},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.40290001034736633},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.40059998631477356},{"id":"https://openalex.org/C66746571","wikidata":"https://www.wikidata.org/wiki/Q1134833","display_name":"ENCODE","level":3,"score":0.35670000314712524},{"id":"https://openalex.org/C2779227376","wikidata":"https://www.wikidata.org/wiki/Q6505497","display_name":"Layer (electronics)","level":2,"score":0.3346000015735626},{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.3285999894142151},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.3278000056743622},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.2833999991416931},{"id":"https://openalex.org/C114289077","wikidata":"https://www.wikidata.org/wiki/Q3284399","display_name":"Statistical model","level":2,"score":0.2808000147342682},{"id":"https://openalex.org/C81363708","wikidata":"https://www.wikidata.org/wiki/Q17084460","display_name":"Convolutional neural network","level":2,"score":0.27880001068115234},{"id":"https://openalex.org/C83665646","wikidata":"https://www.wikidata.org/wiki/Q42139305","display_name":"Feature vector","level":2,"score":0.2759999930858612},{"id":"https://openalex.org/C59404180","wikidata":"https://www.wikidata.org/wiki/Q17013334","display_name":"Feature learning","level":2,"score":0.274399995803833},{"id":"https://openalex.org/C158154518","wikidata":"https://www.wikidata.org/wiki/Q7310970","display_name":"Relevance (law)","level":2,"score":0.2736000120639801},{"id":"https://openalex.org/C2777462759","wikidata":"https://www.wikidata.org/wiki/Q18395344","display_name":"Word embedding","level":3,"score":0.2694000005722046},{"id":"https://openalex.org/C2778907243","wikidata":"https://www.wikidata.org/wiki/Q168160","display_name":"IEC 61850","level":3,"score":0.2662999927997589},{"id":"https://openalex.org/C2781122975","wikidata":"https://www.wikidata.org/wiki/Q16928266","display_name":"Semantic feature","level":2,"score":0.2612999975681305},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.2599000036716461},{"id":"https://openalex.org/C187691185","wikidata":"https://www.wikidata.org/wiki/Q2020720","display_name":"Grid","level":2,"score":0.25940001010894775},{"id":"https://openalex.org/C2775941552","wikidata":"https://www.wikidata.org/wiki/Q25212305","display_name":"Isolation (microbiology)","level":2,"score":0.2538999915122986}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/smartgridcomm65349.2025.11204562","is_oa":false,"landing_page_url":"https://doi.org/10.1109/smartgridcomm65349.2025.11204562","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SmartGridComm)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":10,"referenced_works":["https://openalex.org/W2515572503","https://openalex.org/W3094563240","https://openalex.org/W3113410850","https://openalex.org/W4200523731","https://openalex.org/W4247658678","https://openalex.org/W4285384943","https://openalex.org/W4391423110","https://openalex.org/W4401831195","https://openalex.org/W4404036460","https://openalex.org/W4412438888"],"related_works":[],"abstract_inverted_index":{"This":[0],"paper":[1],"proposes":[2],"a":[3,76,98],"novel":[4],"security":[5],"framework":[6,79],"designed":[7],"to":[8,68,80,102,134,171,200],"protect":[9],"smart":[10],"grid":[11],"systems":[12],"from":[13],"zero-day":[14],"attacks":[15],"that":[16,61,152],"exploit":[17],"vulnerabilities":[18],"in":[19,53,138,174],"the":[20,36,119,129,188],"Manufacturing":[21],"Message":[22],"Specification":[23],"(MMS)":[24],"protocol,":[25],"leveraging":[26,153],"domain-specific":[27],"knowledge.":[28],"Existing":[29],"machine":[30],"learning-based":[31],"IDS":[32,130],"frameworks":[33],"often":[34],"overlook":[35],"contextual":[37],"significance":[38],"of":[39,50,121],"domain-specification,":[40],"which":[41],"can":[42],"provide":[43,198],"valuable":[44],"insights":[45],"into":[46,86],"structure":[47,147],"or":[48],"functionality":[49],"IED":[51,146,180],"targeted":[52],"message.":[54],"We":[55],"propose":[56],"two-layer":[57],"feature":[58,85],"scoring":[59,108],"system":[60],"integrates":[62],"semantic":[63,92],"embedding":[64,78],"and":[65,165,182],"probabilistic":[66],"modeling":[67],"enhance":[69],"threat":[70],"detection.":[71],"The":[72,94],"first":[73],"layer":[74,96],"employs":[75],"Word2vec":[77],"encode":[81],"itemId":[82],"(domain-specification)":[83],"text":[84],"dense":[87],"vector":[88],"representations,":[89],"capturing":[90],"their":[91],"relationships.":[93],"second":[95],"utilizes":[97],"multivariate":[99],"gaussian":[100],"model":[101],"analyze":[103],"these":[104,154],"embeddings,":[105],"enabling":[106],"robust":[107],"based":[109],"on":[110],"statistical":[111],"deviations.":[112],"By":[113],"incorporating":[114],"this":[115],"score":[116],"along":[117],"with":[118],"length":[120],"recently":[122],"accessed":[123],"messages":[124],"around":[125],"each":[126],"domain-specification":[127],"message,":[128],"improves":[131],"its":[132],"ability":[133],"identify":[135],"anomalous":[136,176],"behavior":[137],"MMS":[139],"message":[140],"patterns,":[141],"such":[142,178],"as":[143,161,179],"malware":[144],"conducting":[145],"scans.":[148],"Experimental":[149],"results":[150],"demonstrate":[151],"features":[155],"enables":[156],"one-class":[157],"anomaly":[158],"detection":[159,194],"models\u2014such":[160],"Isolation":[162],"Forest,":[163],"Autoencoder,":[164],"Gaussian":[166],"Mixture":[167],"Model\u2014to":[168],"achieve":[169],"80%":[170],"99%":[172],"accuracy":[173],"identifying":[175],"traffic,":[177],"scanning":[181],"invalid":[183],"journal":[184],"read":[185],"attacks,":[186],"highlighting":[187],"framework\u2019s":[189],"potential":[190],"for":[191],"advancing":[192],"intrusion":[193],"system.":[195],"Additionally,":[196],"we":[197],"rules":[199],"detect":[201],"malicious":[202],"domain":[203],"names.":[204]},"counts_by_year":[],"updated_date":"2026-03-07T16:01:11.037858","created_date":"2025-10-22T00:00:00"}