Abstract:The power grid is a critical infrastructure essential for public safety and welfare. As its reliance on digital technologies grows, so do its vulnerabilities to sophisticated cyber threats, which could severely disrupt operations. Effective protective measures, such as intrusion detection and decision support systems, are essential to mitigate these risks. Machine learning offers significant potential in this field, yet its effectiveness is constrained by the limited availability of high-quality data due to confidentiality and access restrictions. To address this, we introduce a simulation environment that replicates the power grid's infrastructure and communication dynamics. This environment enables the modeling of complex, multi-stage cyber attacks and defensive responses, using attack trees to outline attacker strategies and game-theoretic approaches to model defender actions. The framework generates diverse, realistic attack data to train machine learning algorithms for detecting and mitigating cyber threats. It also provides a controlled, flexible platform to evaluate emerging security technologies, including advanced decision support systems. The environment is modular and scalable, facilitating the integration of new scenarios without dependence on external components. It supports scenario generation, data modeling, mapping, power flow simulation, and communication traffic analysis in a cohesive chain, capturing all relevant data for cyber security investigations under consistent conditions. Detailed modeling of communication protocols and grid operations offers insights into attack propagation, while datasets undergo validation in laboratory settings to ensure real-world applicability. These datasets are leveraged to train machine learning models for intrusion detection, focusing on their ability to identify complex attack patterns within power grid operations.

Towards an Approach to Contextual Detection of Multi-Stage Cyber Attacks in Smart Grids

Real-time Monitoring of Smart Grid Terminals Based on Multi-dimensional Information Fusion

On Holistic Multi-Step Cyberattack Detection via a Graph-based Correlation Approach

Attack Detection for Distributed Photovoltaic Generation Systems Leveraging Cyber and Power Side Channel Data

Vulnerability Assessment of Electrical Cyber-Physical Systems Against Cyber Attacks

On Process Awareness in Detecting Multi-stage Cyberattacks in Smart Grids

On Specification-based Cyber-Attack Detection in Smart Grids

An Approach to Abstract Multi-stage Cyberattack Data Generation for ML-Based IDS in Smart Grids

A Collaborative Characteristic Event Sequence Based Identification Method for Cyberattacks in Cyber-Physical System

An Online Approach to Cyberattack Detection and Localization in Smart Grid

Simulation of Multi-Stage Attack and Defense Mechanisms in Smart Grids

An Approach of Replicating Multi-Staged Cyber-Attacks and Countermeasures in a Smart Grid Co-Simulation Environment

Distributed Attack Detection of Multi-area Power Systems Against False Data Injection Attacks

AI-based Attacker Models for Enhancing Multi-Stage Cyberattack Simulations in Smart Grids Using Co-Simulation Environments

Constrained-Differential-Evolution-Based Stealthy Sparse Cyber-Attack and Countermeasure in an AC Smart Grid

Towards a Comprehensive Framework for Cyber-Incident Response Decision Support in Smart Grids

CCPA: Coordinated Cyber-Physical Attacks and Countermeasures in Smart Grid.

Smart Grid Cyber-Physical Situational Awareness of Complex Operational Technology Attacks: A Review

A cyber-physical digital twin approach to replicating realistic multi-stage cyberattacks on smart grids

Investigating Man-in-the-Middle-based False Data Injection in a Smart Grid Laboratory Environment

Toward an Applied Cyber Security Solution in IoT-Based Smart Grids: An Intrusion Detection System Approach