Abstract: The present disclosure relates to systems and methods for detecting the real-time intrusion in the digital substation. The present disclosure may include a system for real-time intrusion detection that comprising: a processor, wherein the processor is configured to: receive one or more message packets from at least one network switch associated with at least one electrical node of the digital substation. Further, the processor is configured to implement an integrative intrusion analysis on the one or more message packets. Further, the intrusion may be determined in real-time based on the integrative intrusion analysis of the one or more message packets. The system may detect the real-time intrusion while managing the time-sensitive flow of the message packets in the digital substation, in accordance with the present disclosure.

Abstract: The present disclosure relates to securing digital substation. A switching node is configured to connect a decoy network and a substation communication network. Further, a plurality of bogus medium access control (MAC) IDs are created that resembles similar to a plurality of critical media access control (MAC) IDs exchanged between a plurality of intelligent electronic devices (IEDs) present in the substation communication network. Furthermore, the plurality of bogus MAC IDs are provided to the decoy network for communicating with the alien device. In this way, one or more malicious attack requests received from the alien device are detected. Further, the switching node may switch the substation network to the decoy network for displaying a set of bogus MAC IDs to the alien device depending on type of the one or more malicious attack requests.

Abstract: The present disclosure relates to securing digital substation. A switching node is configured to connect a decoy network and a substation communication network. Further, a plurality of bogus medium access control (MAC) IDs are created that resembles similar to a plurality of critical media access control (MAC) IDs exchanged between a plurality of intelligent electronic devices (IEDs) present in the substation communication network. Furthermore, the plurality of bogus MAC IDs are provided to the decoy network for communicating with the alien device. In this way, one or more malicious attack requests received from the alien device are detected. Further, the switching node may switch the substation network to the decoy network for displaying a set of bogus MAC IDs to the alien device depending on type of the one or more malicious attack requests.