Connected and digital electricity substations based on IEC–61850 standards enable novel applications. On the other hand, such connectivity also creates an extended attack surface. Therefore, Intrusion Detection Systems (IDSs) have become an essential component of safeguarding substations from malicious activities. However, in contrast to traditional information technology systems, there is a serious lack of realistic data for training, testing, and evaluating IDSs in smart grid scenarios. Many existing substation IDSs rely on datasets from other contexts or on proprietary datasets that do not allow reproducibility, validation, or performance comparison with competing algorithms. To address this issue, we propose the Efficacious Reproducer Engine for Network Operations (ERENO) synthetic traffic generation framework based on the IEC–61850 standard specifications. As an additional contribution, and as a proof-of-concept, we create and make available a suite of realistic IEC–61850 datasets that model 8 use cases, namely traffic for 7 common attacks and one for normal network traffic. Based on those datasets, we further evaluate how enriched features combining raw data from the substation can significantly improve intrusion detection performance. Our results suggest that it can improve F1-Score up to 47.22% for masquerade attacks.

While there have been important advances within wireless communication technology, the provision of communication support during disaster relief activities remains an open issue. The literature in disaster research reports several major restrictions to conducting first response activities in urban areas, given the limitations of telephone networks and radio systems to provide digital communication in the field. In search-and-rescue operations, the communication requirements are increased, since the first responders need to rely on real-time and reliable communication to perform their activities and coordinate their efforts with other teams. Therefore, these limitations open the door to improvisation during disaster relief efforts. In this paper, we argue that flying ad-hoc networks can provide the communication support needed in these scenarios, and propose a new solution towards that goal. The proposal involves the use of flying witness units, implemented using drones, that act as communication gateways between first responders working at different locations of the affected area. The proposal is named the Flying Real-Time Network, and its feasibility to provide communication in a disaster scenario is shown by presenting both a real-time schedulability analysis of message delivery, as well as simulations of the communication support in a physical scenario inspired by a real incident. The obtained results were highly positive and consistent, therefore this proposal represents a step forward towards the solution of this open issue.

Cyber-physical systems (CPS) are vital to key infrastructures such as Smart Grids and water treatment, and are increasingly vulnerable to a broad spectrum of evolving attacks. Whereas traditional security mechanisms, such as encryption and firewalls, are often inadequate for CPS architectures, the implementation of Intrusion Detection Systems (IDS) tailored for CPS has become an essential strategy for securing them. In this context, it is worth noting the difference between traditional offline Machine Learning (ML) techniques and understanding how they perform under different IDS applications. To answer these questions, this article presents a novel comparison of five offline and three online ML algorithms for intrusion detection using seven CPS-specific datasets, revealing that offline ML is superior when attack signatures are present without time constraints, while online techniques offer a quicker response to new attacks. The findings provide a pathway for enhancing CPS security through a balanced and effective combination of ML techniques.