Detecção interpretável de intrusões em subestações elétricas inteligentes por meio da inteligência artificial explicável

Abstract

This work proposes a solution to improve an Intrusion Detection System (IDS) in the context of electrical substations. The main objective is to integrate explainability capabilities using Explainable Artificial Intelligence (XAI) into IDS, especially to deal with security challenges in communication in electrical substation networks, which are based on the IEC-61850 standard. Furthermore, as a second contribution, the extraction of new features with temporal enrichment techniques was implemented, added to robust pre-processing. The improvement obtained with this in the classification was also possible to be observed by XAI techniques. The results were quite promising, the improvement of the IDS made it less biased towards some attacks and with a better interpretation of complex attacks, such as Masquerade. This approach not only strengthened threat detection, but also made the IDS more reliable, easier to interpret for operators, and simplified analysis of fixes or new functionality implementations, resulting in much more favorable XAI decision-making. This integration of XAI into IDS represented a breakthrough for cybersecurity in electrical substations, providing a stronger and more transparent defense against emerging threats in highly critical environments.