Search

The Smart Grid is an advanced electricity network deeply intertwined with cyber technologies that oversees power generation, long-distance transmission, and final delivery to end users. At its core lies the substation. However, embedding digital systems within substations has dramatically widened the range of potential vulnerabilities. Advanced adversaries, such as those behind the PipeDream APT, deliberately exploit several industrial protocols, including Modbus, DNP3, and IEC61850. Substations face strict operational constraints that complicate the adoption of conventional protective mechanisms, such as data encryption or network intrusion detection systems. To address these difficulties, we present an integrated, trust-centric architecture that significantly strengthens substation defenses. The proposed architecture integrates three main components: a trust evaluation model, a dynamic risk assessment model, and a trust portability model. The trust evaluation model can uncover protocol-specific malicious activities targeting Intelligent Electronic Devices and SCADA human-machine interfaces. The dynamic risk assessment model continuously determines the substation’s current security risk exposure. The trust portability model analyzes whether a device, together with its accumulated trust profile, can be effectively migrated and reused in another substation environment. For a realistic evaluation, we constructed a containerized (Docker) substation replica organized around a multi-agent framework and equipped with a live dashboard modeled after modern Security Operations Centers. Effectiveness was measured by simulating a broad spectrum of adversary behaviors aligned with the MITRE ICS ATT&CK matrix. Experimental results indicate robust resistance to various attack vectors, reliable detection of malicious actions, and appropriate incentivization of well-behaved, trustworthy components. 

The shift of electrical power systems toward intelligent smart-grid architectures delivers better dependability, operational performance, and real-time visibility, yet simultaneously heightens exposure to cyber threats. Thanks to the massive amounts of data now generated in smart grids, machine learning techniques have emerged as a particularly promising avenue for bolstering defensive capabilities. While the strengths of machine-learning solutions for cybersecurity improvement are clear, these same models form part of the attack surface and remain especially susceptible to carefully crafted adversarial perturbations. This work analyzes the resilience of autoencoder-based intrusion detection mechanisms in smart grids against adversarial examples. We begin by presenting an original iterative procedure for synthesizing adversarial instances. Next, we demonstrate that a white-box adversary with full knowledge of the autoencoder detector can reliably produce stealthy, misclassifying samples using the proposed approach. Experimental results show that simply starting from basic adversarial seeds is insufficient to generate effective evasions, underscoring the considerable difficulty of constructing potent adversarial examples targeting autoencoder-based anomaly detectors deployed in smart-grid environments.