  In recent years, critical infrastructure and power grids have experienced a
series of cyber-attacks, leading to temporary, widespread blackouts of
considerable magnitude. Since most substations are unmanned and have limited
physical security protection, cyber breaches into power grid substations
present a risk. Nowadays, software-defined network (SDN), a popular virtual
network technology based on the OpenFlow protocol is being widely used in the
substation automation system. However, the susceptibility of SDN architecture
to cyber-attacks has exhibited a notable increase in recent years, as indicated
by research findings. This suggests a growing concern regarding the potential
for cybersecurity breaches within the SDN framework. In this paper, we propose
a hybrid intrusion detection system (IDS)-integrated SDN architecture for
detecting and preventing the injection of malicious IEC 61850-based generic
object-oriented substation event (GOOSE) messages in a digital substation.
Additionally, this program locates the fault's location and, as a form of
mitigation, disables a certain port. Furthermore, implementation examples are
demonstrated and verified using a hardware-in-the-loop (HIL) testbed that
mimics the functioning of a digital substation.
