Evaluation of Cyberattack Detection Models in Power Grids: Automated Generation of Attack Processes
Source abstract
Abstract
The recent growing adversarial activity against critical systems, such as the power grid, has raised attention on the necessity of appropriate measures to manage the related risks. In this setting, our research focuses on developing tools for early detection of adversarial activities, taking into account the specificities of the energy sector. We developed a framework to design and deploy AI-based detection models, and since one cannot risk disrupting regular operation with on-site tests, we also included a testbed for evaluation and fine-tuning. In the test environment, adversarial activity that produces realistic artifacts can be injected and monitored, and evidence analyzed by the detection models. In this paper we concentrate on the emulation of attacks inside our framework: A tool called SecuriDN is used to define, through a graphical interface, the network in terms of devices, applications, and protection mechanisms. Using this information, SecuriDN produces sequences of attack steps (based on the MITRE ATT&CK project) that are interpreted and executed by software called Netsploit. A case study related to Distributed Energy Resources is presented in order to show the process stages, highlight the possibilities given by our framework, and discuss possible limitations and future improvements.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Smart Grid Security and Resilience · Network Security and Intrusion Detection · Advanced Malware Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Computer Science Institute, DiSIT, Università del Piemonte Orientale, 15121 Alessandria, Italy
Consorzio Nazionale Interuniversitario per le Telecomunicazioni (CNIT), 43124 Parma, Italy
Transmission and Distribution Technologies Department, RSE Ricerca Sistema Energetico, 20134 Milano, Italy
Computer Science Department, Università di Torino, 10149 Torino, Italy
References (49)
Show source-provided references
1. Stuxnet: Dissecting a Cyberwarfare Weapon10.1109/MSP.2011.67 ↗
2. Khan, R., Maynard, P., Mclaughlin, K., Laverty, D., and Sezer, S. (2016, January 23–25). Threat Analysis of BlackEnergy Malware for Synchrophasor based Real-time Control and Monitoring in Smart Grid. Proceedings of the 4th International Symposium for ICS & SCADA Cyber Security Research (ICS-CSR), Belfast, UK.10.14236/ewic/ICS2016.7 ↗
3. Salazar, L., Castro, S.R., Lozano, J., Koneru, K., Zambon, E., Huang, B., Baldick, R., Krotofil, M., Rojas, A., and Cardenas, A.A. (2024, January 20–23). A Tale of Two Industroyers: It was the Season of Darkness. Proceedings of the IEEE Symposium on Security and Privacy (SP), San Francisco, CA, USA.10.1109/SP54263.2024.00162 ↗
4. Stouffer, K., Pease, M., Tang, C., Zimmerman, T., Pillitteri, V., Lightman, S., Hahn, A., Saravia, S., Sherule, A., and Thompson, M. (2025, September 22). Guide to Operational Technology (OT) Security, Available online: https://csrc.nist.gov/pubs/sp/800/82/r3/final.
5. Cerotti, D., Codetta Raiteri, D., Dondossola, G., Egidi, L., Franceschinis, G., Portinale, L., Savarro, D., and Terruggia, R. (2024). SecuriDN: A Modeling Tool Supporting the Early Detection of Cyberattacks to Smart Energy Systems. Energies, 17.10.3390/en17163882 ↗
6. Haes Alhelou, H., Hatziargyriou, N., and Dong, Z.Y. (2023). A Modular Infrastructure for the Validation of Cyberattack Detection Systems. Power Systems Cybersecurity: Methods, Concepts, and Best Practices, Springer International Publishing.10.1007/978-3-031-20360-2 ↗
7. Ukwandu, E., Farah, M.A.B., Hindy, H., Brosset, D., Kavallieros, D., Atkinson, R., Tachtatzis, C., Bures, M., Andonovic, I., and Bellekens, X. (2020). A review of cyber-ranges and test-beds: Current and future trends. Sensors, 20.10.3390/s20247148 ↗
8. Gunathilaka, P., Mashima, D., and Chen, B. (2016, January 28). Softgrid: A software-based smart grid testbed for evaluating substation cybersecurity solutions. Proceedings of the 2nd ACM Workshop on Cyber-Physical Systems Security and Privacy, Vienna, Austria.10.1145/2994487.2994494 ↗
9. Testbed@ TWISC: A network security experiment platform10.1002/dac.3446 ↗
10. A survey on industrial control system testbeds and datasets for security research10.1109/COMST.2021.3094360 ↗
11. Development of cyber-physical security testbed based on IEC 61850 architecture10.5755/j01.eie.25.5.24361 ↗
12. Karch, M., Rösch, D., André, K., Meshram, A., Haas, C., and Nicolai, S. (2022, January 6–9). CrossTest: A cross-domain physical testbed environment for cybersecurity performance evaluations. Proceedings of the 2022 IEEE 27th International Conference on Emerging Technologies and Factory Automation (ETFA), Stuttgart, Germany.10.1109/ETFA52439.2022.9921672 ↗
13. Design and implementation of cybersecurity testbed for industrial IoT systems10.1007/s11227-017-2219-z ↗
14. Jarmakiewicz, J., Maślanka, K., and Parobczak, K. (2015, January 18–19). Development of cyber security testbed for critical infrastructure. Proceedings of the International Conference on Military Communications and Information Systems, Cracow, Poland.10.1109/ICMCIS.2015.7158687 ↗
15. Establishment of intrusion detection testbed for CyberManufacturing systems10.1016/j.promfg.2018.07.142 ↗
16. Intrusion detection routers: Design, implementation and evaluation using an experimental testbed10.1109/JSAC.2006.877214 ↗
17. Vigna, G., Robertson, W., and Balzarotti, D. (2004, January 25–29). Testing network-based intrusion detection signatures using mutant exploits. Proceedings of the 11th ACM Conference on Computer and Communications Security, Washington, DC, USA.10.1145/1030083.1030088 ↗
18. Rossey, L.M., Cunningham, R.K., Fried, D.J., Rabek, J.C., Lippmann, R.P., Haines, J.W., and Zissman, M.A. (2002, January 9–16). LARIAT: Lincoln adaptable real-time information assurance testbed. Proceedings of the IEEE Aerospace Conference, Big Sky, MT, USA.
19. Singaraju, G., Teo, L., and Zheng, Y. (2004, January 8–9). A testbed for quantitative assessment of intrusion detection systems using fuzzy logic. Proceedings of the 2nd IEEE International Information Assurance Workshop, Charlotte, NC, USA.
20. Haines, J.W., Goulet, S.A., Durst, R.S., and Champion, T.G. (2003, January 18–20). LLsim: Network simulation for correlation and response testing. Proceedings of the Systems, Man and Cybernetics Society, Information Assurance Workshop, West Point, NY, USA.
21. Zilberman, P., Puzis, R., Bruskin, S., Shwarz, S., and Elovici, Y. (2020). Sok: A survey of open-source threat emulators. arXiv.
22. Cheong, J. (2025, September 22). AutoTTP: Automated Tactics Techniques & Procedures 2019. Available online: https://github.com/jymcheong/AutoTTP.
23. BC-Security (2025, September 22). Empire: Post-Exploitation Framework. Available online: https://github.com/BC-SECURITY/Empire.
24. Bader, L., Serror, M., Lamberts, O., Sen, O., van der Velde, D., Hacker, I., Filter, J., Padilla, E., and Henze, M. (2023, January 3–7). Comprehensively Analyzing the Impact of Cyberattacks on Power Grids. Proceedings of the 2023 IEEE 8th European Symposium on Security and Privacy (EuroS&P), Delft, The Netherlands.10.1109/EuroSP57164.2023.00066 ↗
25. Peuster, M., Karl, H., and van Rossem, S. (2016, January 7–10). MeDICINE: Rapid prototyping of production-ready network services in multi-PoP environments. Proceedings of the 2016 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN), Palo Alto, CA, USA.10.1109/NFV-SDN.2016.7919490 ↗
26. Pandapower—An Open-Source Python Tool for Convenient Modeling, Analysis, and Optimization of Electric Power Systems10.1109/TPWRS.2018.2829021 ↗
27. (2006). Telecontrol Equipment and Systems—Part 5-104: Transmission Protocols—Network Access for IEC 60870-5-101 Using Standard Transport Profiles (Standard No. IEC 60870-5-104).
28. The MITRE Corporation (2025, September 22). Adversarial Tactics, Techniques and Common Knowledge (ATT&CK). Available online: https://attack.mitre.org/.
29. The MITRE Corporation (2025, September 22). ATT&CK for Enterprise. Available online: https://attack.mitre.org/matrices/enterprise/.
30. The MITRE Corporation (2025, September 22). ATT&CK for Industrial Control Systems. Available online: https://attack.mitre.org/matrices/ics/.
31. Codetta Raiteri, D., Franceschinis, G., and Gribaudo, M. (2006, January 26). Defining formalisms and models in the Draw-Net Modelling System. Proceedings of the International Workshop on Modelling of Objects, Components and Agents, Turku, Finland.
32. Marco, G., Mazzocca, N., Francesco, M., and Vittorini, V. (2005, January 19–22). Multisolution of complex performability models in the OsMoSys/DrawNET framework. Proceedings of the Second International Conference on the Quantitative Evaluation of Systems (QEST’05), Torino, Italy.10.1109/QEST.2005.22 ↗
33. Calvarese, F., Di Marco, A., and Malavolta, I. (2011, January 27–29). Towards a graphical representation for the Æmilia Architecture Description Language. Proceedings of the 2nd Quantitative Information Workshop (infQ), Lipari, Italy.
34. Gilmore, S., and Gribaudo, M. (2003, January 2–5). Graphical modelling of process algebras with DrawNET. Proceedings of the Tools presentation at the Multiconference on Measurement, Modelling and Evaluation of Computer-Communication Systems, Urbana, IL, USA.
35. The MITRE Corporation (2025, September 22). Cyber Analytics Repository (CAR). Available online: https://car.mitre.org/.
36. Eaton, J.W. (2025, September 22). Octave. Available online: https://www.gnu.org/software/octave/.
37. Rapid7 (2025, September 22). Metasploit Framework. Available online: https://www.metasploit.com.
38. Docker, Inc. (2025, September 22). Docker Stack CLI Reference. Available online: https://docs.docker.com/reference/cli/docker/stack/.
39. Docker, Inc. (2025, September 22). Docker Swarm. Available online: https://docs.docker.com/engine/swarm/.
40. Cerotti, D., Codetta Raiteri, D., Egidi, L., Franceschinis, G., Portinale, L., Dondossola, G., and Terruggia, R. (October, January 29). Analysis and Detection of Cyber Attack Processes targeting Smart Grids. Proceedings of the IEEE-PES Innovative Smart Grid Technologies Europe (ISGT-Europe), Bucharest, Romania.
41. Degano, P., and Zunino, R. (2019, January 13–15). A Bayesian Network Approach for the Interpretation of Cyber Attacks to Power Systems. Proceedings of the 3rd Italian Conference on Cyber Security, Pisa, Italy. CEUR Workshop Proceedings.
42. Toward scalable graph-based security analysis for cloud networks10.1016/j.comnet.2022.108795 ↗
43. Topological sorting of large networks10.1145/368996.369025 ↗
44. Miller, M. (2025, September 22). Metasploit’s Meterpreter. Last Modified 26 December 2004. Available online: https://www.hick.org/code/skape/papers/meterpreter.pdf.
45. Rapid7 (2025, September 22). Meterpreter — Metasploit Documentation. Available online: https://docs.metasploit.com/docs/using-metasploit/advanced/meterpreter/meterpreter.html.
46. Junior, G.T., Clara Araujo Gomes Da Silva, A., Dos Santos, R.P., Kassab, M., and Graciano Neto, V.V. (2025, January 3). Are SoIS the Majority of SoS? An Exploratory Investigation of Subtypes of Systems-of-Systems in the Literature. Proceedings of the 2025 IEEE/ACM 13th International Workshop on Software Engineering for Systems-of-Systems and Software Ecosystems (SESoS), Ottawa, ON, Canada.10.1109/SESoS66601.2025.00007 ↗
47. Linnosmaa, J., Alanen, J., Karadeniz, S., Tiusanen, R., Berger, J., Malm, T., and Viitanen, K. (2024). System of Systems Modelling for Safety and Cyber Security Assessments, VTT Technical Research Centre of Finland. Number VTT-R-00555-24 in VTT Research Report.
48. Fontes, R.R., Afzal, S., Brito, S.H.B., Santos, M.A.S., and Rothenberg, C.E. (2015, January 13–15). Mininet-WiFi: Emulating software-defined wireless networks. Proceedings of the 2015 11th International Conference on Network and Service Management (CNSM), Barcelona, Spain.10.1109/CNSM.2015.7367387 ↗
49. Guo, R., Chen, Q., Tong, S., and Liu, H. (2024, January 5–8). Knowledge-Aided Generative Adversarial Network: A Transfer Gradient-Less Adversarial Attack for Deep Learning-Based Soft Sensors. Proceedings of the 2024 14th Asian Control Conference (ASCC), Dalian, China.