Anomaly detection in substation networks