To address the risk of measurement value distortion in remote terminal units caused by false data injection attacks(FDIA)in power monitoring systems

a non-invasive anomaly detection model of the IEC 60870-5-104 protocol deployed at the network boundary of power communication systems

aiming to enhance operational security and business continuity assurance capabilities is proposed.The core of the proposed model is based on a Gaussian process regression framework

which dynamically constructs historical measurement baselines for each remote terminal unit through an online learning mechanism

and models the long-term frequency distribution characteristics of measurement values to capture their long-term operational patterns.Experimental results from a simulation test platform demonstrate that the model can effectively distinguish between normal measurement data and abnormal patterns induced by FDIA

accurately identifying anomalous measurements. Its dynamic baseline update mechanism adapts to the time-varying characteristics of grid operations

reducing false detection rates.By establishing independent models for each terminal

the system significantly improves its adaptability to diverse grid operating conditions.