Abstract:The transition to smart grids has increased the vulnerability of electrical power systems to advanced cyber threats. To safeguard these systems, comprehensive security measures-including preventive, detective, and reactive strategies-are necessary. As part of the critical infrastructure, securing these systems is a major research focus, particularly against cyberattacks. Many methods are developed to detect anomalies and intrusions and assess the damage potential of attacks. However, these methods require large amounts of data, which are often limited or private due to security concerns. We propose a co-simulation framework that employs an autonomous agent to execute modular cyberattacks within a configurable environment, enabling reproducible and adaptable data generation. The impact of virtual attacks is compared to those in a physical lab targeting real smart grids. We also investigate the use of large language models for automating attack generation, though current models on consumer hardware are unreliable. Our approach offers a flexible, versatile source for data generation, aiding in faster prototyping and reducing development resources and time.
What problem does this paper attempt to address?
### What problems does this paper attempt to solve?
This paper aims to solve the problem of advanced network threats faced by smart grids during their transformation towards intelligence. As smart grids are increasingly integrated with information and communication technologies (ICT), their interconnectivity with external devices is enhanced, and the original physical isolation barrier is broken, exposing smart grids to new cybersecurity threats. To ensure the security of these systems, comprehensive security measures, including prevention, detection, and response strategies, need to be adopted.
However, existing methods for detecting anomalies and intrusions and for evaluating the potential damage of attacks rely on a large amount of data, which is often limited or privatized for security reasons. Therefore, a major challenge for researchers is how to generate sufficient, high - quality data to support the cybersecurity research and system evaluation of smart grids.
To this end, the paper proposes a co - simulation framework that uses autonomous agents to execute modular network attacks in a configurable environment, enabling repeatable and adaptable data generation. Specifically, the objectives of the paper are:
1. **Define problems and requirements**: Clearly define how to automatically generate network logs and power simulation results in multi - stage network attacks on smart grids.
2. **Design and evaluate AI - driven attack models**: Design and evaluate AI - based attack models in a simulation environment, and describe in detail the physical laboratory and co - simulation structure, the operation of autonomous agents, the deployment environment, and the data generation process.
3. **Comparative analysis**: Evaluate the effectiveness of the data generation process through comparative analysis with the digital twin method used in the physical laboratory.
### Specific problems and solutions
- **Data scarcity**: For security reasons, many smart grid operators are reluctant to disclose their data, making it difficult for researchers to obtain sufficient data. To solve this problem, the paper proposes a simulation method that automatically runs network attacks, which can generate network logs and power simulation results in a virtual environment, thus providing a rich data set that can be used for training and testing.
- **Complexity and scalability**: Manual red teaming methods pose challenges in terms of consistency and scalability, and automation becomes a promising solution. The framework proposed in the paper can automatically execute multi - stage network attacks and configure different scenarios according to predefined parameters, ensuring the consistency and repeatability of attack simulations.
- **Authenticity and consistency**: The generated data must be both authentic and consistent to ensure its usability in practical applications. The paper ensures the quality of the generated data by defining four main indicators (power simulation results, time propagation, traffic volume, protocol distribution), enabling it to accurately reflect the impact of network attacks on smart grids.
### Conclusion
By introducing AI - based attack models and a co - simulation environment, the paper provides a flexible and versatile data generation method, which helps to accelerate prototyping and reduce development resources and time. This comprehensive approach not only improves the availability of data but also eliminates the need for expensive physical experiment setups, thus providing a solid foundation for the cybersecurity research of smart grids.