Detecting MITM Attacks Using DNN in IIoT Substation Systems - Prasetya, Dwi; Renaldo Permana, Dendi; Al Hamas, M. Rafie; Stiawan, Deris; A. Alghamdi, Tami; Budiarto, Rahmat (International Journal of Online and Biomedical Engineering (iJOE), 2026)
The integration of the Industrial Internet of Things (IIoT) in electrical substation systems has improved efficiency in operations but brought them under greater exposure to cyber threats, such as increased vulnerability to cyberattacks, particularly man-in-the-middle (MITM) attacks where information is altered and grid stability is affected. A deep neural network (DNN) structure dedicated to identifying MITM attacks on IIoT substation environments is presented in this paper. A large dataset of normal and attack network traffic was acquired by using a SCADA simulator to generate a realistic operating scenario. With 99.78% accuracy and ideal precision, recall, and F1-measures of classifying attack traffic, the proposed DNN model exhibits superior classification performance. An ontology that converts network anomalies into actionable operational insights for operators is used to visualize the detection results in an attempt to improve interpretability. Contextual visualization and correct anomaly detection cooperate to form a strong and valuable cybersecurity solution that safeguards critical infrastructure against sophisticated cyberattacks.