From: Comparison of approaches for intrusion detection in substations using the IEC 60870-5-104 protocol
Detection method
False positive packets
Undetected attack packets
Snort
0
823
Supervised
31
Semi-supervised
136
56
Unsupervised
6211
2880