FlagThis

Abstract

Smart grids use communication networks and intelligent electronic devices for reliable and automated operation of power systems. As these systems become increasingly interconnected, they are also becoming more exposed to cyberattacks such as message tampering, false command injection, and denialof-service attacks. One particularly concerning threat is False Data Injection (FDI), where attackers manipulate communication messages by deleting, modifying, or adding packets. This is especially crucial in IEC 61850-based substations, where Generic Object-Oriented Substation Event (GOOSE) messages are used for delivering time-critical protection and control information between devices. Detecting FDI attacks in IEC 61850 GOOSE traffic remains challenging because malicious packets can closely resemble legitimate communication, making them difficult to distinguish from normal operational behaviour. Furthermore, many existing detection methods depend heavily on manually engineered protocol features, which require extensive domain knowledge and may not generalise well across different smart grid environments. This paper proposes FDIFormer, a featureengineering-free framework for FDI attack detection using structured textual representations of GOOSE packet sequences and fine-tuned pre-trained Transformer models. The proposed framework converts protocol packets into structured text windows that capture communication behaviour and enables Transformer models to learn attack-related patterns directly from the data. The framework is evaluated using the QUT-ZSS-2023-GOOSE dataset under a scenario-level three-fold cross-validation strategy. Experimental results show that GraphCodeBERT achieves an MCC of 0.595 ± 0.122, achieving performance comparable to the strongest feature-engineered baseline, XGBoost (MCC = 0.604 ± 0.121), while improving MCC by 0.133 compared with the TF-IDF baselines. These findings demonstrate that pre-trained Transformer representations can provide an effective technique for FDI attack detection in IEC 61850 GOOSE communication without relying on manually engineered protocol features.