The integration of advanced communication systems and distributed resources has transformed power systems, enhancing control and efficiency in the Smart Grid. However, this increased complexity introduces new vulnerabilities, heightening risks of cyber-attacks, equipment failures, and other anomalies. Anomaly detection methods increasingly rely on Machine Learning techniques, that represent a game-changer tool for data analysis. The aim of this survey is to review anomaly detection techniques in the Smart Grid, focusing on methods that combine Artificial Intelligence and physics-based modeling. Thiswork systematically examines the current state of research, evaluating the investigated use cases, the algorithms, the performances and the validation of the papers, identifying key gaps, and offering insights for advancing in this research field.

The increasing integration of cyber-physical systems in industrial environments has underscored the critical need of robust security mechanisms to counteract evolving cyber threats. To allow a full performance evaluation of these security mechanisms as well as the extension of their detection skills concerning new cyber-physical-attacks, this paper introduces an open-source dataset, called Industrial Control System - Anomaly Detection Dataset (ICS-ADD). ICS-ADD would like to be a valuable resource for researchers and practitioners who aim to develop, test, and benchmark new cyber-physical security monitoring and detection technologies. ICS-ADD comprises raw network traffic captures of an industrial control system (ICS) subjected to a variety of simulated cyber-attacks, including but not limited to denial of service (DoS), man-in-the-middle (MITM), and malware infiltration. In addition to raw network traffic, ICS-ADD includes the output of two widely utilized open-source security monitoring tools, OSSIM (Open Source Security Information Management) and Suricata, which offer insights concerning the detection and analysis capabilities of existing security frameworks against threats. The analysis appearing in this paper highlights the complexity and variety of modern cyber threats in industrial environments and the novelty of ICS-ADD with respect to publicly available datasets. The reported performance analysis of OSSIM and Suricata by using ICS-ADD reveals areas of improvement for the detection of new attacks, which will be object of future research concerning the protection of industrial control systems.

The way of generating and distributing energy throughout the electrical grid to all users is evolving. The concept of Smart Grid (SG) took place to enhance the management of the electrical grid infrastructure and its functionalities from the traditional system to an improved one. To measure the energy consumption of the users is one of these functionalities that, in some countries, has already evolved from a periodical manual consumption reading to a more frequent and automatic one, leading to the concept of Smart Metering (SM). Technology improvement could be applied to the SM systems to allow, on one hand, a more efficient way to collect the energy consumption data of each user, and, on the other hand, a better distribution of the available energy through the infrastructure. Widespread communication solutions based on existing telecommunication infrastructures instead of using ad-hoc ones can be exploited for this purpose. In this paper, we recall the basic elements and the evolution of the SM network architecture focusing on how it could further improve in the near future. We report the main technologies and protocols which can be exploited for the data exchange throughout the infrastructure and the pros and cons of each solution. Finally, we propose an innovative solution as a possible evolution of the SM system. This solution is based on a set of Internet of Things (IoT) communication technologies called Low Power Wide Area Network (LPWAN) which could be employed to improve the performance of the currently used technologies and provide additional functionalities. We also propose the employment of Unmanned Aerial Vehicles (UAVs) to periodically collect energy consumption data, with evident advantages especially if employed in rural and remote areas. We show some preliminary performance results which allow assessing the feasibility of the proposed approach.

Critical Infrastructures (CIs) are sensible targets. They could be physically damaged by natural or human actions, causing service disruptions, economic losses, and, in some extreme cases, harm to people. They, therefore, need a high level of protection against possible unintentional and intentional events. In this paper, we show a logical architecture that exploits information from both physical and cybersecurity systems to improve the overall security in a power plant scenario. We propose a Machine Learning (ML)-based anomaly detection approach to detect possible anomaly events by jointly correlating data related to both the physical and cyber domains. The performance evaluation showed encouraging results—obtained by different ML algorithms—which highlights how our proposed approach is able to detect possible abnormal situations that could not have been detected by using only information from either the physical or cyber domain.

Microgrids are growing in importance in the Smart Grid paradigm for power systems. Microgrid security is becoming crucial since these systems increasingly rely on information and communication technologies. Many technologies have been proposed in the last few years for the protection of industrial control systems, ranging from cryptography, network security, security monitoring systems, and innovative control strategies resilient to cyber-attacks. Still, electrical systems and microgrids present their own peculiarities, and some effort has to be put forth to apply cyber-protection technologies in the electrical sector. In the present work, we discuss the latest advancements and research trends in the field of microgrid cybersecurity in a tutorial form.

Software Defined Networking (SDN) is a very useful tool not only to manage networks but also to increase network security, in particular by implementing Intrusion Detection Systems (IDS) directly into the SDN architecture. The implementation of IDS within the SDN paradigm can simplify the implementation, speed up incident responses, and, in general, allow to promptly react to cyber attacks through proper countermeasures. Nevertheless, embedding IDS within SDN also introduces delays that cannot be tolerated in specific network environments, like industrial control systems. This paper focuses on the implementation of an IDS based on Machine Learning (ML) algorithms into an SDN architecture and proposes a very practical approach to reduce the delay by using the sequential implementation of prototypes of increasing software and hardware complexity so allowing quick tests to highlight the main problems, solve them and pass to the next operative step. A fully validated performance evaluation is then shown by exploiting all the presented solutions and by using further improved hardware features. The overall performance is very good and compliant with most, even if not yet all, industrial control systems constraints. Results show how the proposed solutions provide a significant improvement of the latency so opening the door to a real implementation in the field.