Search

The Smart Grid is an advanced electricity network deeply intertwined with cyber technologies that oversees power generation, long-distance transmission, and final delivery to end users. At its core lies the substation. However, embedding digital systems within substations has dramatically widened the range of potential vulnerabilities. Advanced adversaries, such as those behind the PipeDream APT, deliberately exploit several industrial protocols, including Modbus, DNP3, and IEC61850. Substations face strict operational constraints that complicate the adoption of conventional protective mechanisms, such as data encryption or network intrusion detection systems. To address these difficulties, we present an integrated, trust-centric architecture that significantly strengthens substation defenses. The proposed architecture integrates three main components: a trust evaluation model, a dynamic risk assessment model, and a trust portability model. The trust evaluation model can uncover protocol-specific malicious activities targeting Intelligent Electronic Devices and SCADA human-machine interfaces. The dynamic risk assessment model continuously determines the substation’s current security risk exposure. The trust portability model analyzes whether a device, together with its accumulated trust profile, can be effectively migrated and reused in another substation environment. For a realistic evaluation, we constructed a containerized (Docker) substation replica organized around a multi-agent framework and equipped with a live dashboard modeled after modern Security Operations Centers. Effectiveness was measured by simulating a broad spectrum of adversary behaviors aligned with the MITRE ICS ATT&CK matrix. Experimental results indicate robust resistance to various attack vectors, reliable detection of malicious actions, and appropriate incentivization of well-behaved, trustworthy components.