Resilience through Cyber-Layer Defense in Digital Substations

Abstract

Modern power grids operate as highly interconnected cyber-physical systems (CPSs), with extensive integration of information and communications technology (ICT) enabling efficient and automated operation. As part of this evolution, IEC 61850-based digital substations have become a key advancement in power-system monitoring, protection, and control. However, the reliance on cyber components such as Intelligent Electronic Devices (IEDs) increases susceptibility to cyber intrusions, demanding enhanced substation cyber resilience. Existing research has not yet established an integrated framework that comprehensively ad dresses the key dimensions of cyber resilience in digital substations, particularly cyber-attack mitigation and recovery. Mitigation refers to containing a cyber-attack within the cyber layer before it propagates to the physical system. Recovery refers to restoring normal operation following an intrusion. To address these challenges, the Smart Cyber Switching (SCS) con troller with a novel IED concurrency feature is proposed. Upon detecting an attack by the embedded intrusion detection schemes, Software-Defined Networking (SDN) capabilities of the SCS controller isolate compromised IED traffic and restore system operation via Concur rent IEDs (CIEDs). The proposed methodology is validated using an advanced CPS security testbed, whose design, implementation, and validation are also developed and presented in this dissertation. Furthermore, this dissertation contributes to enhancing cyber-layer intrusion detection. Cyber attacks against digital substations are often carried out as broader multi-phase strategies. Existing Intrusion Detection Systems (IDSs) often flag only isolated symptoms and lack the attack-phase context needed for effective mitigation. The proposed Substation Cyber Attack Strategy Phasing (SubCASP) fuses IDS data logs to infer the attack phases. The method is validated using an ATTandCK-based attack-graph dataset. Building upon the proposed technologies for digital substations, this dissertation extends cyber-layer defense to another emerging CPS, Artificial Intelligence Data Centers (AIDCs), whose manipulation as mega-loads can impose significant impacts on the power grid. Specif ically, a potential coordinated cyber-attack targeting multiple AIDC mega-loads is modeled, and a cyber-layer defense methodology is proposed and validated through integrated cyber physical simulations utilizing the IEEE 39-bus system model. This extension demonstrates that the proposed cyber-layer defense concepts can transcend digital substations, paving the way for proactive containment of cyber threats before they inflict physical damage across modern CPSs.