Alerga: Alert Aggregation and Reasoning in GOOSE Simulation Pipeline

Jude Battista, Klara Nahrstedt, Alfonso Valdes, Shane McFly

Research output: Contribution to conferencePaper


IEC 61850 specifies the Generic Object Oriented Substation Event (GOOSE) protocol as one option for low latency communication of substation-related events. Due to its strict timing requirements, GOOSE lacks any form of encryption or authentication and has only minimal integrity guarantees. These absences render the protocol vulnerable to a variety of communication anomalies, including adversarial action. In particular, an adversary with access to the substation network can launch man in the middle (MITM) attacks. We propose Alerga, a set of tools to allow operators to mitigate some of the risks of the protocol while retaining its strengths. To that end, we have developed first a GOOSE simulation pipeline including data generation, anomaly detection, alert handling, causal reasoning and data visualization components. The simulator is designed to be modular, allowing operators to swap components to better fit their network capabilities. The volume of alert traffic on a substation network threatens operators with alert fatigue. In order to combat this, we secondly present a novel form of alert aggregation and processing, offering operators a condensed view of any threats to the system. Thirdly, to facilitate the handling of these threats, our causal reasoning system traces the alerts back to their most likely cause, generating an initial hypothesis for operators to investigate.
Original languageAmerican English
Number of pages6
StatePublished - 2023
EventIEEE SmartGridComm - Glasgow, Scotland
Duration: 31 Oct 20233 Nov 2023


ConferenceIEEE SmartGridComm
CityGlasgow, Scotland

NREL Publication Number

  • NREL/CP-5T00-88766


  • alert aggregation
  • causal reasoning
  • network simulation


Dive into the research topics of 'Alerga: Alert Aggregation and Reasoning in GOOSE Simulation Pipeline'. Together they form a unique fingerprint.

Cite this