GOOSE (Generic Object Oriented Substation Event) data intrusion detection method, device and system

The invention provides a GOOSE data intrusion detection method, device and system, and the method comprises the steps: obtaining GOOSE data which is communication data of a power system; feature extraction is carried out on the GOOSE data to obtain feature vectors, and the feature vectors comprise basic features, statistical features, time sequence features and frequency domain features; the feature vectors are input into a classification model to obtain behavior types, the classification model is obtained through training of multiple sets of training data, each set of training data in the multiple sets of training data comprises historical feature vectors corresponding to historical GOOSE data and historical behavior types corresponding to the historical GOOSE data, and the behavior types comprise normal communication behaviors and hostile attack behaviors; and when the behavior type is a hostile attack behavior, intrusion is determined, so that the problem that the intrusion of the power system cannot be de