Detection of microgrid cyberattacks using network and system management
Abstract
Microgrids, as a major domain of smart grids, facilitate the integration of distributed and renewable energy sources. They are capable of operating autonomously when the connection to the main grid is difficult or cost-ineffective. As the presence of microgrids in the smart grid becomes more common, it becomes more urgent to protect the microgrid from cyberattacks. In this paper, we present the first design and implementation of a microgrid security monitoring platform based on IEC 62351–7:2017 Network and System Management (NSM). The capabilities of this platform are demonstrated on a detailed microgrid model that is deployed on a real-time co-simulation testbed. A hybrid rule-based and machine learning anomaly detection approach is developed to detect attacks targeting the microgrid. To investigate the effectiveness of the NSM security monitoring platform, evaluate the proposed detection schemes, and observe the impact of cyberattacks on the microgrid operation, several formulated attacks against the microgrid are simulated. The effectiveness of different parameters and architectures for the anomaly detection schemes are compared against one another, including Long Short-Term Memory (LSTM) and Gated Recurrent Unit (GRU). The obtained results demonstrate the strengths and gaps of security monitoring based on NSM, and can be seen as first step towards the design of more comprehensive monitoring platforms that integrate NSM along with complementary mechanisms such as passive network traffic inspection and device log analysis.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
For IEC-104 protocol-based delay, modification, and loss attacks, Karanfil [135]'s proposed framework achieved average F1-scores above 0.92, demonstrating that integrated analysis of network and control-layer data can simultaneously support attack detection and physical impact assessment in microgrids.
“For IEC-104 [140] protocol-based delay, modification, and loss attacks, the proposed framework achieved average F1-scores above 0.92, demonstrating that integrated analysis of network and control-layer data can simultaneously support attack detection and physical impact assessment in microgrids.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [135]
Karanfil [135] analyzed the collected data using a hybrid scheme that combines rule-based detection with LSTM/GRU-based unsupervised models.
“The collected data are analyzed using a hybrid scheme that combines rule-based detection with LSTM/GRU-based unsupervised models.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [135]
Ensemble and decision-fusion-based hybrid data studies explicitly combine detectors with heterogeneous inductive biases-tree ensembles, kernel methods, deep sequence models, and state observers-so that cyber-layer traffic anomalies and physical-layer process deviations are jointly reflected in the final decision, improving robustness under noisy hybrid data and nonstationary operating regimes.
“First, they explicitly combine detectors with heterogeneous inductive biases-tree ensembles, kernel methods, deep sequence models, and state observers-so that cyber-layer traffic anomalies and physical-layer process deviations are jointly reflected in the final decision, improving robustness under noisy hybrid data and nonstationary operating regimes [133-137].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [135]
Many ensemble and decision-fusion frameworks perform decision-level fusion rather than strict feature-level fusion, aggregating per-model outputs via voting schemes or risk evaluation engines; this design simplifies deployment across diverse ICS domains because existing detectors can be reused while the fusion logic is tuned to plant-specific safety and criticality requirements.
“Second, many frameworks perform decision-level fusion rather than strict feature-level fusion, aggregating per-model outputs via voting schemes or risk evaluation engines; this design simplifies deployment across diverse ICS domains because existing detectors can be reused while the fusion logic is tuned to plant-specific safety and criticality requirements [133-136].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [135]
Karanfil [135] proposed a cyber-physical hybrid anomaly detection framework for detecting cyberattacks in microgrid environments using Network and System Management (NSM) data compliant with IEC 62351-7:2017.
“Karanfil [135] proposed a cyber-physical hybrid anomaly detection framework for detecting cyberattacks in microgrid environments using Network and System Management (NSM) data compliant with IEC 62351-7:2017 [139].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [135]
In Karanfil [135], a HYPERSIM-based microgrid co-simulation environment was used, and network-layer NSM traffic and MIB statistics were collected alongside control-layer operational state variables, enabling a hybrid data-driven approach that jointly detects physical and communication anomalies.
“In a HYPERSIM-based microgrid co-simulation environment, network-layer NSM traffic and MIB statistics are collected alongside control-layer operational state variables, enabling a hybrid data-driven approach that jointly detects physical and communication anomalies.”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [135]
Cites
Chandola, V., Banerjee, A., & Kumar, V. (2009) · ACM Computing Surveys · doi:10.1145/1541880.1541882 · Cited by 11,687 · see citing works
Olivares, D. E., Mehrizi-Sani, A., Etemadi, A. H., Canizares, C. A., Iravani, R., Kazerani, M., Hajimiragha, A. H., Gomis-Bellmunt, O., Saeedifard, M., Palma-Behnke, R., et al. (2014) · IEEE Transactions on Smart Grid · doi:10.1109/tsg.2013.2295514 · Cited by 3,137 · see citing works
Learning to forget: continual prediction with LSTM
Gers, F. A. (1999) · doi:10.1049/cp:19991218 · Cited by 2,436 · see citing works
Hierarchical Structure of Microgrids Control System
Bidram, A., & Davoudi, A. (2012) · IEEE Transactions on Smart Grid · doi:10.1109/tsg.2012.2197425 · Cited by 1,523 · see citing works
The 2015 Ukraine Blackout: Implications for False Data Injection Attacks
Liang, G., Weller, S. R., Zhao, J., Luo, F., & Dong, Z. Y. (2017) · IEEE Transactions on Power Systems · doi:10.1109/tpwrs.2016.2631891 · Cited by 1,248 · see citing works
Distributed Secondary Control for Islanded Microgrids—A Novel Approach
Shafiee, Q., Guerrero, J. M., & Vásquez, J. C. (2013) · IEEE Transactions on Power Electronics · doi:10.1109/tpel.2013.2259506 · Cited by 1,087 · see citing works
Microgrids : architectures and control
Hatziargyriou, N. D. (2014) · CERN Document Server (European Organization for Nuclear Research) · Cited by 682 · see citing works
Cyber‐physical attacks and defences in the smart grid: a survey
He, H., & Yan, J. (2016) · IET Cyber-Physical Systems Theory & Applications · doi:10.1049/iet-cps.2016.0019 · Cited by 457 · see citing works
A Survey on Security Communication and Control for Smart Grids Under Malicious Cyber Attacks
Peng, C., Sun, H., Yang, M., et al. (2019) · IEEE Transactions on Systems Man and Cybernetics Systems · doi:10.1109/tsmc.2018.2884952 · Cited by 401 · see citing works
An Intrusion Detection System Using a Deep Neural Network With Gated Recurrent Units
Xu, C., Shen, J., Du, X., & Zhang, F. (2018) · IEEE Access · doi:10.1109/access.2018.2867564 · Cited by 339 · see citing works
Ahmed, S., Lee, Y.-D., Hyun, S.-H., & Koo, I. (2019) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2019.2902822 · Cited by 294 · see citing works
Microgrid control: A comprehensive survey
Sen, S., & Kumar, V. (2018) · Annual Reviews in Control · doi:10.1016/j.arcontrol.2018.04.012 · Cited by 228 · see citing works
Parag, Y., & Ainspan, M. (2019) · Energy Sustainable Development/Energy for sustainable development · doi:10.1016/j.esd.2019.07.003 · Cited by 151 · see citing works
A Machine-Learning-Based Cyber Attack Detection Model for Wireless Sensor Networks in Microgrids
Kavousi‐Fard, A., Su, W., & Jin, T. (2020) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2020.2964704 · Cited by 151 · see citing works
ANGEL: An Intelligent Digital Twin Framework for Microgrid Security
Danilczyk, W., Sun, Y. L., & He, H. (2019) · North American Power Symposium (NAPS) · doi:10.1109/naps46351.2019.9000371 · Cited by 127 · see citing works
Chlela, M., Mascarella, D., Joós, G., & Kassouf, M. (2017) · IEEE Transactions on Smart Grid · doi:10.1109/tsg.2017.2667586 · Cited by 123 · see citing works
Self-citationMultiterminal Hybrid Protection of Microgrids Over Wireless Communications Network
Ustun, T. S., & Khan, R. H. (2015) · IEEE Transactions on Smart Grid · doi:10.1109/tsg.2015.2406886 · Cited by 121 · see citing works
Cyber Physical Security Analytics for Transactive Energy Systems
Zhang, Y., Krishnan, V., Pi, J., Kaur, K., Srivastava, A. K., Hahn, A., & Suresh, S. (2019) · IEEE Transactions on Smart Grid · doi:10.1109/tsg.2019.2928168 · Cited by 96 · see citing works
Lei, M., & Mohammadi, M. (2021) · International Journal of Electrical Power & Energy Systems · doi:10.1016/j.ijepes.2020.106702 · Cited by 75 · see citing works
A Secure Communication Architecture for Distributed Microgrid Control
Kounev, V., Tipper, D., Yavuz, A. A., et al. (2015) · IEEE Transactions on Smart Grid · doi:10.1109/tsg.2015.2424160 · Cited by 66 · see citing works
Stateful intrusion detection for IEC 60870-5-104 SCADA security
Yang, Y., McLaughlin, K., Sezer, S., Yuan, Y., & Huang, W. (2014) · IEEE Power Engineering Society General Meeting · doi:10.1109/pesgm.2014.6939218 · Cited by 48 · see citing works
Du, Y., Tu, H., Lukic, S. M., et al. (2018) · doi:10.1109/egrid.2018.8598696 · Cited by 31 · see citing works
Power Converters Based Advanced Experimental Platform for Integrated Study of Power and Controls
Liu, W., Kim, J.-M., Wang, C., et al. (2018) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2018.2830382 · Cited by 29 · see citing works
Real-Time Control and Operation for a Flexible Microgrid with Dynamic Boundary
Ma, Y., Hu, X., Yin, H., et al. (2018) · IEEE Energy Conversion Congress and Exposition (ECCE) · doi:10.1109/ecce.2018.8558364 · Cited by 26 · see citing works
OpenStack-Based Evaluation Framework for Smart Grid Cyber Security
Albarakati, A., Moussa, B., Debbabi, M., et al. (2018) · IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SmartGridComm) · doi:10.1109/smartgridcomm.2018.8587420 · Cited by 20 · see citing works
Self-citationDetecting a Stealthy Attack in Distributed Control for Microgrids using Machine Learning Algorithms
Ma, M., Lahmadi, A., & Chrisment, I. (2020) · doi:10.1109/icps48405.2020.9274721 · Cited by 20 · see citing works
Microgrid communication network with combined technology
Islam, M., & Lee, H. (2016) · International Conference on Informatics, Electronics and Vision · doi:10.1109/iciev.2016.7760039 · Cited by 9 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Seo, J. K., Lee, J., Kim, B., Shim, W., & Seo, J. T. (2025) · Electronics · doi:10.3390/electronics15010020 · Cited by 15 · see citing works
- Authors
- Karanfil, M., Rebbah, D. E., Debbabi, M., Kassouf, M., Ghafouri, M., Youssef, E.-N. S., & Hanna, A.
- Affiliations
- Concordia University (CA)
- Hydro-Québec (CA)
- ORCID
- Venue
- IEEE Transactions on Smart Grid
- Published
- 2023-05
- Volume
- 14
- Issue
- 3
- Pages
- 2390-2405
- ISSN
- 1949-3053 (ISSN-L)
- 1949-3061
- OpenAlex
- W4312650043
- Cited by
- 51
- References
- 28
- Citations by year
- 2026: 11 · 2025: 20 · 2024: 13 · 2023: 7
- FWCI
- 4.03
- Type
- journal article
- Language
- en
- Open access
- closed
- Licence
- Locations
- IEEE Transactions on Smart Grid (publishedVersion)
- Funders
- NSERC/Hydro-Québec/Thales Senior Industrial Research Chair in Smart Grid Security: Detection, Prevention, Mitigation, and Recovery from Cyber-Physical Attacks (NSERC IRCPJ 501621-15)
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Engineering › Electrical and Electronic Engineering › Power System Optimization and Stability
- Keywords
- microgrid cybersecurity, cyberattack detection, anomaly detection, rule-based detection, LSTM, GRU, smart grid security
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
