The distributed structure of traditional networks often fails to promptly and accurately provide the computational power required for artificial intelligence (AI), hindering its practical application and implementation. Consequently, this research aims to analyze the use of AI in software-defined networks (SDNs). To achieve this goal, a systematic literature review (SLR) is conducted based on the PRISMA 2020 statement. Through this review, it is found that, bottom-up, from the perspective of the data plane, control plane, and application plane of SDNs, the integration of various network planes with AI is feasible, giving rise to Intelligent Software Defined Networking (ISDN). As a primary conclusion, it was found that the application of AI-related algorithms in SDNs is extensive and faces numerous challenges. Nonetheless, these challenges are propelling the development of SDNs in a more promising direction through the adoption of novel methods and tools such as route optimization, software-defined routing, intelligent methods for network security, and AI-based traffic engineering, among others.

This paper proposes a multilevel intrusion detection system (M‐IDS) using the KDD‐Cup‐99 Dataset to detect various types of attacks on computer networks. The IDS consists of three levels and six classifiers, targeting denial of service (DoS), probing attack (PA), remote to local (R2L), and user to root (U2R) attack categories. At level 1, the first classifier identifies DoS, PA, and a class grouping R2L, U2R, and Normal. Level 2 employs three classifiers to identify attack forms corresponding to DoS, PA, R2L, U2R, and Normal. Level 3 includes two classifiers for identifying R2L and U2R attack forms. Support vector machines (SVMs), k ‐nearest neighbors ( k ‐NNs), and semi‐supervised fuzzy c ‐means (SSFCMs) classifiers were evaluated, with SVM and k ‐NN performing best in levels 1 and 2, and SSFCM excelling in level 3. The proposed M‐IDS was tested using the UNSW‐NB15 Dataset, achieving errors lower than 1% in levels 1 and 2 and around 7% in level 3 for the KDD‐Cup‐99 Dataset.

The increasing digitalization of electrical substations, enabled by IEC 61850-based architectures, has improved operational efficiency while expanding the cyber attack surface. This paper introduces a standards-aligned cybersecurity risk mitigation model specifically designed for digital substations and mapped to representative attack scenarios. The model integrates preventive, detective, and application-level controls derived from NIST SP 800-82r3, IEC 62443, and ISO/IEC 27019, and is validated in a laboratory process-bus environment. A baseline risk assessment identified four high-risk scenarios in the studied digital substation architecture. For validation, a selected subset of controls was experimentally evaluated against two representative attack vectors, namely false data injection (FDI) on GOOSE messages and denial-of-service (DoS) against PTP synchronization. For the remaining scenarios, the post-mitigation effects were reassessed analytically based on control coverage, architectural exposure, and standards-aligned cybersecurity reasoning. The experimental validation demonstrated that both empirically tested high-risk scenarios (FDI on GOOSE and DoS on PTP) were effectively mitigated, reducing their residual risk to moderate and low levels, respectively. For the remaining two scenarios, a post-mitigation analytical reassessment based on control coverage and architectural exposure suggested a consistent risk reduction trend, although without direct experimental confirmation. Under this combined empirical–analytical assessment, the number of high-risk scenarios decreased from four to one, corresponding to a 50% experimentally validated reduction in high-risk exposure, complemented by an analytical reassessment of the remaining scenarios. These results provide quantitative evidence about the effectiveness of the model, even with partial implementation. The scientific contribution of this study lies in integrating multistandard cybersecurity requirements into an operational mitigation model tailored to IEC 61850 substations, combined with experimental risk quantification in a realistic process-bus testbed. The proposed model offers practical guidance for utilities and establishes a scalable foundation for advancing cybersecurity in critical power infrastructure.