According to one or more embodiments of the disclosure, a device obtains one or more System Configuration Description Language files regarding a power utility automation network. The device also obtains traffic data regarding traffic in the power utility automation network. The device trains, using the one or more System Configuration Description Language files and the traffic data, a behavioral model for the power utility automation network that models traffic in the power utility automation network. The device initiates use of the behavioral model in the power utility automation network to identify anomalous traffic behavior in the power utility automation network.