Pith. sign in

REVIEW 4 major objections 7 minor 134 references

Simulation of Multi-Stage Attack and Defense Mechanisms in Smart Grids

T0 review · 4 major / 7 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A unified co-simulation environment integrates power-grid and communication behavior to generate realistic multi-stage attack data for training machine-learning intrusion detectors.

desk verdict A useful integrated simulation environment for smart grid attack data, but the realism claim rests on thin validation and the ML evaluation has a logical inconsistency. read the letter →

arxiv 2412.06255 v1 pith:P6BRKTP5 submitted 2024-12-09 cs.CR

Omer Sen , Bozhidar Ivanov , Christian Kloos , Christoph Zol_ , Philipp Lutat , Martin Henze , Andreas Ulbig This is my paper · ORCID
classification cs.CR
keywords smartgridcybersecurityco-simulationmulti-stagecyberattackintrusiondetectionsystemfalsedatainjectiongametheoryIEC60870-5-104syntheticgeneration
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that a single co-simulation environment, joining a steady-state power-flow model with a custom network simulation of IEC 60870-5-104 over TCP/IP, can generate realistic and varied cyber attack data for smart grids. Because real attack data for critical infrastructure is hard to obtain, the authors aim to supply a controlled alternative: synthetic data covering multi-stage attacks, false data injection, and denial of service, produced under consistent conditions. The central claim is that this environment replicates both the physical behavior of the grid and communication processes precisely enough that machine-learning intrusion detectors trained on its output can recognize complex attack patterns. The paper tests this claim in laboratory scenarios, compares simulated outcomes with physical measurements, and demonstrates the resulting data's usefulness by training several ML classifiers.

What carries the argument

The central mechanism is the integrated co-simulation chain: a power-flow grid model mapped through a hierarchical graph into field, station, and WAN layers, where custom Switch, Router, and RTU classes simulate L2-L4 operations and speak IEC 60870-5-104 at the application layer. Attack generation uses logical attack graphs to compute attacker paths, an ICS kill-chain-driven propagator to move through subnets, and an FDI module that builds an attack vector $\vec{a} = H\vec{c}$ satisfying $a_k = 0$ on protected measurements so bad-data detection stays silent. The attacker-defender dynamics are steered by a game-theoretic loop in which edge weights $W_{i,j} = \frac{t_j^{\text{attacker}}}{C_j^{\text{attacker}} \cdot P_j^{\text{attacker}}}$ and defender risk $\text{Risk} = \sum_i P_i \cdot C_i \cdot Q_i$ are updated across rounds, with sensor placement guided by current-flow betweenness centrality $c_{CB}(v)$. All data lands in Unified2-format alert logs that feed ML classifiers, which are then evaluated for detection quality.

What would settle it

Run one of the paper's attack scenarios (for example, ICMP flooding or ARP spoofing) in a physical lab where all network traffic is captured with packet inspection tools, then run the same scenario in the simulator and compare packet-level metrics such as inter-arrival times, loss rates, and latency distributions under identical load; if the simulated traffic deviates from the measured values by more than the calibration tolerance for these attack types, the claim of accurate multi-stage attack data generation would be refuted.

Watch

Extended reading notes

Core claim

On the authors' own terms, the discovery is that an SGAM-based, layer-segregated model of a distribution grid—built with graph and power-flow tools, and extended with a polymorphic network simulation of Ethernet, IP, TCP, and IEC 60870-5-104—can act as a closed-loop environment where power flow, control operations, multi-stage attack propagation, and defensive responses all leave traces in one consistent dataset. Attack propagation follows an ICS kill chain formalized with logically generated attack graphs; the final stage uses a stealthy false data injection vector $\vec{a} = H \vec{c}$ that preserves the residual norm $\|r_a\|_2 = \|r\|_2$ and therefore evades bad data detection. A game-theoretic attacker-defender loop, parameterized by Dijkstra-based path weighting, time-to-compromise, and current-flow betweenness centrality, varies the data so that trained ML models see both simple and complex attack patterns. Laboratory tests of ARP spoofing and ICMP flooding against a physical low-voltage setup show, the paper contends, close agreement with simulated trajectories, establishing the platform's claim to realism.

Load-bearing premise

The model assumes that the custom communication layer, calibrated with just two measurements of data rate and latency, faithfully reproduces network behavior for every simulated attack type, including multi-stage propagation and false data injection; if that assumption fails, the synthetic attack data will not mirror real attack traffic.

Editorial extensions

If this is right

  • If the simulation is faithful, researchers can produce labeled multi-stage attack datasets for smart grids without requiring access to real critical infrastructure.
  • ML-based intrusion detection systems trained on the synthetic data, particularly Extreme Gradient Boosting and Random Forest, reach high detection scores and improve as attack complexity and attacker skill evolve over simulation rounds.
  • Including an active defender in data generation changes attack complexity and improves downstream detection compared with data produced by random or single-path attack strategies.
  • The same environment can serve as a testbed for evaluating decision support systems built on attack-defense trees, including Sobol sensitivity analysis and countermeasure selection.
  • Adjusting firewall segmentation and attacker metadata changes propagation paths, which lets users study how defense-in-depth configurations limit the reach of multi-stage attacks.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The communication model is calibrated with only two latency-throughput measurements, so its fidelity for complex attack traffic (e.g., ARP spoofing under load, or coordinated multi-subnet propagation) remains untested; a packet-level comparison on a real IEC 104 testbed would be a direct stress test.
  • If the simulation were packaged as an open, standardized scenario generator, it could serve as a common benchmark for comparing intrusion detectors across different grid topologies and attack configurations.
  • The game-theoretic loop suggests a natural extension to adaptive defense: sensor placement learned from prior attack rounds could be benchmarked against a static or reactive baseline in a hardware-in-the-loop setup.
  • The FDI construction assumes the attacker knows the full topology and protected measurement set; a partial-information variant would be a harder, more realistic test for detection algorithms trained on this data.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. The paper presents a modular, Python-based co-simulation environment that couples a PandaPower-based distribution grid model with a custom communication model implementing Ethernet, IP, TCP, and IEC 60870-5-104 at the application layer. On top of this, the authors add multi-stage cyber attack simulation (IT propagation, C2, lateral movement), false data injection (FDI) attack vector construction, a game-theoretic attacker-defender framework, laboratory validation for two simple attack types, and use of the resulting synthetic data to train ML-based intrusion detection models. The central claim is that this environment 'replicates the power grid's infrastructure and communication behavior' with high precision, thereby generating realistic multi-stage attack data for ML-based IDS training and for evaluating a decision support system.

Significance. If the central claim were established, the framework would be a valuable response to the scarcity of realistic ICS/SCADA attack datasets. The paper's strengths include a detailed description of the layered SGAM-based architecture, a transparent analytical treatment of FDI attack vectors (Eqs. 7–12), explicit use of MITRE ATT&CK and MulVAL concepts, a laboratory test for two concrete attack types, and a comparative ML evaluation across several classifiers. The authors also honestly acknowledge some limitations in Sections VIII-C, IX-D, and XII-A. However, the validation chain is too thin for the paper's strongest claims: the communication model is calibrated from only two latency/throughput measurements, the laboratory validation covers only ARP spoofing and ICMP flooding with qualitative agreement, and the multi-stage and FDI data used for training ML models are not validated against any external attack dataset or real FDI traffic. The claim of 'high precision' in the conclusion is therefore not supported for the complex scenarios that constitute the paper's main contribution.

major comments (4)
  1. [Section VIII-B, Section X-C, Section XII-A] The central claim that the simulation generates realistic multi-stage attack data for ML-based IDS is not supported by the provided validation. Section VIII-B compares simulation and laboratory only for ARP spoofing and ICMP flooding, using qualitative plots (Figure 9) and no quantitative error or statistical metrics. These are L2/L3 attacks, whereas the IDS training datasets in Section X come from 21-subnet multi-stage scenarios with C2, lateral movement, and FDI (Sections VI-B and IX). The conclusion in Section XII-A states that experiments demonstrated 'the high precision of our simulation platform in replicating both the physical behavior of the power grid and the communication processes under both normal and attack-induced conditions,' but this statement overreaches the evidence presented. The ML performance metrics in Table VI are computed only on data from the same simulator, so the models may be learning simulator-specific artifacts rather than authentic attack behavior. This is a load-bearing gap for the paper's stated purpose of providing realistic training data.
  2. [Section VIII-A] The communication model is calibrated from only two measurements: a 941 Mbit/s data rate and 343 µs RTT between two laptops on Gigabit Ethernet, and a 540 µs RTT from a laptop to a PV inverter control device. This calibration is then extended to a 21-subnet, WAN-like topology in Section X, with no validation that the model captures latency distributions, congestion dynamics, queueing behavior, or IEC 60870-5-104 protocol timing under complex multi-stage attacks. The assumed fidelity of the communication model for these scenarios is load-bearing for the realism of the generated traffic, but the provided evidence is insufficient to support it.
  3. [Section IX-C, Equations (7)–(12)] The FDI attack case studies demonstrate that the constructed attack vectors satisfy the algebraic stealth condition |ra|2 = |r|2, but they do not validate that the resulting manipulated measurements would evade real bad-data detection implementations in a deployed grid operator environment, nor that the synthetic traffic's protocol-level timing and measurement patterns match real FDI traffic. In addition, the simulations assume that the attacker has already compromised the relevant RTUs and has perfect knowledge of the Jacobian; the authors themselves note in Section IX-D that this assumption 'may not hold in a secure grid environment.' Without external validation of the FDI-generated data, the claim that the generated datasets are realistic for IDS training remains unsubstantiated.
  4. [Section VII, Equations (13)–(19)] The game-theoretic attacker-defender model is a central component of the data generation process, but its fidelity is not validated. The learning rules for attacker success probabilities, defender risk updates (Eq. 14), and the 'learning rate' Qi are introduced without empirical grounding, and the claim in Section VII that this framework yields 'diverse, realistic attack data' is asserted rather than demonstrated. Since the model determines the attack paths and defensive responses that generate the training data, its realism is load-bearing for the IDS evaluation; the paper provides no comparison with real adversarial decision-making or with an existing attack dataset. This is a correctness-risk concern that could be addressed by testing the generated data against external benchmark data (e.g., CICIDS2017 or ICS-specific datasets) or by validating the game dynamics against documented multi-stage attacks such as the Ukrainian grid incident.
minor comments (7)
  1. [Section VIII-B] The text says 'four distinct scenarios were examined,' listing one normal scenario, an ARP spoofing scenario, and two ICMP flooding attacks, but the description and Figure 9 do not clearly separate the two ICMP flooding variants; please make the scenario list explicit and label the figure panels accordingly.
  2. [Section II-A] The sentence 'RTUs at primary and secondary substations are connected via Modbus at the level of RTUs' is confusingly worded; please clarify which protocol is used where (Modbus between IEDs and RTUs, IEC 60870-5-104 between RTUs and the MTU).
  3. [Table V] The entries 'application id NA' and 'sequence number NA' are ambiguous; please state whether these fields are not present in the Unified2 format or simply not used in the generated alerts.
  4. [Section X-A] The claim that attack graph construction has computational complexity O(N^3) is stated without derivation or reference; please provide a citation or a brief justification.
  5. [References] There are duplicate references: [12] and [13] cite the same paper, and [47] and [132] also cite the same paper; please consolidate them to avoid confusion.
  6. [Section VI-A] Equation (3) uses the notation ż = Hx but does not define the measurement noise or the relationship between ż and the actual measurements z; please clarify the notation and align it with the later use in Section VI-C.
  7. [Section XI-B] In Table VII, the MITM node (At 8) shows a risk reduction from 1.15 to 0.71 after countermeasures, but the text states it 'did not show a significant reduction in risk'; please reconcile this statement with the numbers or define what 'significant' means here.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the simulation derivation chain is self-contained, and the lab-validation gap is an external-validity limitation rather than a circular reduction.

full rationale

Walking the paper's derivation chain, each load-bearing step is either derived from external inputs or reproduced within the paper. The FDI attack construction (Section VI-C, Eqs. 7-12) follows the standard formulation a = Hc, and Eq. 9 is an algebraic identity showing the residual norm is unchanged; this is a derivation from Liu et al. [118], not a fitted prediction. The communication model is parameterized from two laboratory latency/throughput measurements (Section VIII-A) and then compared with laboratory ARP-spoofing and ICMP-flooding runs (Section VIII-B); this is a calibration and concordance check, not a "prediction" forced from the same fitted quantity, because the simulated attack outcomes are emergent and not direct re-statements of the calibrated parameters. The multi-stage attack formalism is stated to be 'based on prior works [110]', but Algorithms 3 and 4 are given in the paper, so the argument does not reduce to an unverified self-citation. ML-based IDS evaluation (Section X) is performed on data generated by the same simulation; while this limits external validity, it is not circular in the derivation sense: the models are fitted and tested on the same generator, but the reported accuracies are not used as the proof that the generator is realistic. The paper itself acknowledges the limitation that 'outcomes can be biased by parameter selection and may not capture the complexity of real-world networks' (Section IX-D) and that the environment 'relies on theoretical models that may not fully capture the complexity of real-world human factors and cyber attacks' (Section XII-A). These are correctness and validation concerns, not circular reductions, so the circularity score is 0.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central claim rests on several hand-chosen parameters (attacker skill progression, sensor count, financial scenarios) and domain assumptions about attacker knowledge, operator visibility, and model fidelity. No new physical entities are introduced; the simulation components are software objects representing standard grid and network concepts.

free parameters (5)
  • Initial attacker expertise = 0.5, increasing by 0.02 per attack to 1.0 at attack 25
    Set by hand in Section X-B to shape the complexity of generated attack data; not derived from empirical data.
  • Number of IDS sensors = 5 to 15
    Chosen in Section X-A because it 'optimally balanced' alert rates in their scenarios; no formal criterion is given.
  • Financial scenario parameters = Unspecified initial capital and incremental funds across three scenarios
    Hand-picked in Section X-B to vary attack difficulty; the actual values are not disclosed.
  • Outage cost scenario duration = 12 hours
    Assumed in Section VII-F for calculating outage costs; arbitrary assumption that directly affects risk values.
  • Voltage and loading thresholds = 0.965 to 1.055 pu and 100% line loading
    Set in Section IX-C for the test grid; plausible but scenario-specific and not justified by a standard.
assumptions (5)
  • domain assumption The attacker has complete knowledge of the grid topology and the Jacobian matrix H when constructing the FDI attack vector.
    Invoked in Section VI-C (Equations 7-12); standard in FDI literature but strong and rarely satisfied in practice.
  • domain assumption The distribution system operator has comprehensive knowledge of the grid state, including topology and state variables.
    Assumed in Section VI-A; simplifies real operational practice, which often involves imperfect observability.
  • ad hoc to paper The game-theoretic attacker and defender learning dynamics, including success probability updates and risk learning rates, faithfully represent real adversarial behavior.
    Defined in Sections VII-D and VII-E; no empirical grounding outside the simulation and no comparison with real attacker behavior.
  • domain assumption The custom communication simulation, calibrated on latency and throughput, reproduces realistic network behavior under attack.
    Used throughout Sections IV and VIII; only two simple attack scenarios are compared with the laboratory, so the assumption is weakly tested.
  • standard math Backbone libraries PandaPower and NetworkX correctly model grid power flow and graph operations.
    Used in Section V; well-established open-source tools, so this is a reasonable background assumption.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Simulation of Multi-Stage Attack and Defense Mechanisms in Smart Grids." pith.science (2026). https://pith.science/paper/P6BRKTP5

@misc{pith2026241206255,
  author       = {Pith},
  title        = {Pith review of: Simulation of Multi-Stage Attack and Defense Mechanisms in Smart Grids},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/P6BRKTP5}},
  note         = {Machine review of arXiv:2412.06255}
}
read the original abstract

The power grid is a critical infrastructure essential for public safety and welfare. As its reliance on digital technologies grows, so do its vulnerabilities to sophisticated cyber threats, which could severely disrupt operations. Effective protective measures, such as intrusion detection and decision support systems, are essential to mitigate these risks. Machine learning offers significant potential in this field, yet its effectiveness is constrained by the limited availability of high-quality data due to confidentiality and access restrictions. To address this, we introduce a simulation environment that replicates the power grid's infrastructure and communication dynamics. This environment enables the modeling of complex, multi-stage cyber attacks and defensive responses, using attack trees to outline attacker strategies and game-theoretic approaches to model defender actions. The framework generates diverse, realistic attack data to train machine learning algorithms for detecting and mitigating cyber threats. It also provides a controlled, flexible platform to evaluate emerging security technologies, including advanced decision support systems. The environment is modular and scalable, facilitating the integration of new scenarios without dependence on external components. It supports scenario generation, data modeling, mapping, power flow simulation, and communication traffic analysis in a cohesive chain, capturing all relevant data for cyber security investigations under consistent conditions. Detailed modeling of communication protocols and grid operations offers insights into attack propagation, while datasets undergo validation in laboratory settings to ensure real-world applicability. These datasets are leveraged to train machine learning models for intrusion detection, focusing on their ability to identify complex attack patterns within power grid operations.

Figures

Figures reproduced from arXiv: 2412.06255 by the authors.

Figure 1
Figure 1. The diagram illustrates the structured methodology of attack and defense simulation for smart grids, highlighting co-simulation, game-theoretic [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Comprehensive Overview of the Integrated Power Grid Communication and Simulation Model. This figure illustrates the multi-layered approach to [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. An exemplary illustration of the hierarchically object-orientated SGAM-based modeling concept for grid simulation. [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (11 more)
Figure 4
Figure 4. Figure 4: Overview of the communication model within the simulation environ [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 5
Figure 5. Figure 5: Sequence diagram illustrating grid operation management with verification process in response to FDI attacks and normal conditions. [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]
Figure 6
Figure 6. Figure 6: A comprehensive representation of our approach, highlighting a game-theoretic model that simulates the dynamic interactions in cyber warfare, [PITH_FULL_IMAGE:figures/full_fig_p017_6.png]
Figure 7
Figure 7. Figure 7: Depiction of the interactive dynamics between attacker and defender, [PITH_FULL_IMAGE:figures/full_fig_p018_7.png]
Figure 8
Figure 8. Figure 8: Overview of the laboratory setup illustrating an MV/LV grid with battery storage systems, PV inverters, and load banks. These components are [PITH_FULL_IMAGE:figures/full_fig_p020_8.png]
Figure 9
Figure 9. Figure 9: Overview of the results from the experiments conducted in both the laboratory and the simulation environment. Plot a) represents the normal scenario [PITH_FULL_IMAGE:figures/full_fig_p021_9.png]
Figure 10
Figure 10. Figure 10: Illustration of the simulated attack propagation within the simulation environment with respect to different scenario constellations. [PITH_FULL_IMAGE:figures/full_fig_p023_10.png]
Figure 11
Figure 11. Figure 11: Complexity assessment of conducted attacks under various initial [PITH_FULL_IMAGE:figures/full_fig_p026_11.png]
Figure 12
Figure 12. Figure 12: Evaluation of the RF model. The x-axis represents the simulation [PITH_FULL_IMAGE:figures/full_fig_p027_12.png]
Figure 15
Figure 15. Figure 15: Illustration of the ADT scenario for the DSS experiment. [PITH_FULL_IMAGE:figures/full_fig_p029_15.png]
Figure 16
Figure 16. Figure 16: Illustration of quadrant plot depicting the DSS result to the ADT [PITH_FULL_IMAGE:figures/full_fig_p029_16.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

134 extracted references · 80 canonical work pages

  1. [1]

    Methods for Actors in the Electric Power System to Prevent, Detect and React to ICT Attacks and Failures,

    D. van der Velde et al. , “Methods for Actors in the Electric Power System to Prevent, Detect and React to ICT Attacks and Failures,” in Proceedings of the 6th IEEE International Energy Conference (ENERGYCon), 2020

    2020

  2. [2]

    Cybersecurity in power grids: Challenges and opportunities,

    T. Krause et al. , “Cybersecurity in power grids: Challenges and opportunities,” Sensors, vol. 21, no. 18, p. 6225, 2021

    2021

  3. [3]

    Analysis of the cyber attack on the ukrainian power grid,

    D. U. Case, “Analysis of the cyber attack on the ukrainian power grid,” E-ISAC, 2016

    2016

  4. [4]

    Comprehensively analyzing the impact of cyberattacks on power grids,

    L. Bader et al., “Comprehensively analyzing the impact of cyberattacks on power grids,” Euro S&P, 2023

    2023

  5. [5]

    Intrusion and intrusion detection,

    J. McHugh, “Intrusion and intrusion detection,” IJIS, 2001

    2001

  6. [6]

    IPAL: Breaking up Silos of Protocol-dependent and Domain-specific Industrial Intrusion Detection Systems,

    K. Wolsing et al. , “IPAL: Breaking up Silos of Protocol-dependent and Domain-specific Industrial Intrusion Detection Systems,” in Pro- ceedings of the 25th International Symposium on Research in Attacks, Intrusions and Defenses (RAID) , 2022

    2022

  7. [7]

    A real-time decision support system for roadway network incident response logistics,

    K. G. Zografos et al., “A real-time decision support system for roadway network incident response logistics,” Transportation Research Part C: Emerging Technologies, vol. 10, no. 1, pp. 1–18, 2002

    2002

  8. [8]

    A.-A. Bouramdane, “Cyberattacks in smart grids: Challenges and solving the multi-criteria decision-making for cybersecurity options, including ones that incorporate artificial intelligence, using an analyt- ical hierarchy process,” Journal of Cybersecurity and Privacy , vol. 3, no. 4, pp. 662–705, 2023

    2023

Show all 134 references
  1. [9]

    A False Sense of Security? Revisiting the State of Ma- chine Learning-Based Industrial Intrusion Detection,

    D. Kus et al., “A False Sense of Security? Revisiting the State of Ma- chine Learning-Based Industrial Intrusion Detection,” in Proceedings of the 8th ACM Cyber-Physical System Security Workshop (CPSS) , 2022

    2022

  2. [10]

    Serious games as a tool to model attack and defense scenarios for cyber-security exercises,

    M. M. Yamin et al. , “Serious games as a tool to model attack and defense scenarios for cyber-security exercises,” Computers & Security, vol. 110, p. 102450, 2021

    2021

  3. [11]

    A framework for modeling and structural vulnerability analysis of spatial cyber-physical power systems from an attack– defense perspective,

    Z. Dong et al., “A framework for modeling and structural vulnerability analysis of spatial cyber-physical power systems from an attack– defense perspective,” IEEE Systems Journal , vol. 15, no. 1, pp. 1369– 1380, 2020

    2020

  4. [13]

    A game-theoretic approach to modeling attacks and defenses of smart grids at three levels,

    X. G. Shan et al. , “A game-theoretic approach to modeling attacks and defenses of smart grids at three levels,” Reliability Engineering & System Safety, vol. 195, p. 106683, 2020

    2020

  5. [14]

    Cyber attack and defense emulation agents,

    J. D. Yoo et al., “Cyber attack and defense emulation agents,” Applied Sciences, vol. 10, no. 6, p. 2140, 2020

    2020

  6. [15]

    A game-theoretic approach for power systems defense against dynamic cyber-attacks,

    S. Hasan et al., “A game-theoretic approach for power systems defense against dynamic cyber-attacks,” International Journal of Electrical Power & Energy Systems , vol. 115, p. 105432, 2020

    2020

  7. [16]

    Gridattacksim: A cyber attack simulation framework for smart grids,

    T. D. Le et al., “Gridattacksim: A cyber attack simulation framework for smart grids,” Electronics, vol. 9, no. 8, p. 1218, 2020

    2020

  8. [17]

    Cyber-physical power system (cpps): A review on modeling, simulation, and analysis with cyber security applications,

    R. V . Yohanandhan et al. , “Cyber-physical power system (cpps): A review on modeling, simulation, and analysis with cyber security applications,” IEEE Access, vol. 8, pp. 151 019–151 064, 2020

    2020

  9. [18]

    Investigation of multi-stage attack and defense simu- lation for data synthesis,

    ¨O. Sen et al. , “Investigation of multi-stage attack and defense simu- lation for data synthesis,” in 2023 International Conference on Smart Energy Systems and Technologies (SEST) . IEEE, 2023, pp. 1–6

    2023

  10. [19]

    Network Security and Privacy for Cyber-Physical Systems,

    M. Henze et al. , “Network Security and Privacy for Cyber-Physical Systems,” in Security and Privacy in Cyber-Physical Systems: Foun- dations, Principles, and Applications, H. Song et al., Eds. Wiley-IEEE Press, 2017

    2017

  11. [20]

    Schavemaker et al., Electrical power system essentials

    P. Schavemaker et al., Electrical power system essentials . John Wiley & Sons, 2017

    2017

  12. [21]

    The electric power grid: Today and tomorrow,

    M. Amin et al., “The electric power grid: Today and tomorrow,” MRS bulletin, vol. 33, no. 4, pp. 399–407, 2008

    2008

  13. [22]

    Gharavi et al., Smart grid: The electric energy system of the future

    H. Gharavi et al., Smart grid: The electric energy system of the future . IEEE Piscataway, NJ, USA, 2011, vol. 99

    2011

  14. [23]

    B. M. Buchholz et al., Smart Grids-fundamentals and technologies in electricity networks. Springer, 2014, vol. 396

    2014

  15. [24]

    G. M. Masters, Renewable and efficient electric power systems . John Wiley & Sons, 2013

    2013

  16. [25]

    Heuristic methodology for planning ac rural medium-voltage distribution grids,

    O. D. Montoya et al. , “Heuristic methodology for planning ac rural medium-voltage distribution grids,” Energies, vol. 14, no. 16, p. 5141, 2021

    2021

  17. [26]

    An overview of pera and the purdue methodology,

    T. Williams, “An overview of pera and the purdue methodology,” Architectures for Enterprise Integration , 1996

    1996

  18. [27]

    Modbus Application Protocol Specification V1. 1b3. 2012,

    MICIE, “Modbus Application Protocol Specification V1. 1b3. 2012,” MICIE Consortium, 2020

    2012

  19. [28]

    Telecontrol equipment and systems—Part 5-104: Transmission Protocols—Network Access for IEC 60870-5-101 Using Standard Transport Profiles,

    IEC, “Telecontrol equipment and systems—Part 5-104: Transmission Protocols—Network Access for IEC 60870-5-101 Using Standard Transport Profiles,” IEC Standard, 2006

    2006

  20. [29]

    James et al

    M. James et al. , Improving the Cybersecurity of the Electric Distri- bution Grid: Identifying Obstacles and Presenting Best Practices for Enhanced Grid Security: Phase 1 Report . Institute for Energy and the Environment, Vermont Law School, 2019

    2019

  21. [30]

    Detection of false data injection attacks in smart grid communication systems,

    D. B. Rawat et al., “Detection of false data injection attacks in smart grid communication systems,” IEEE Signal Processing Letters, vol. 22, no. 10, pp. 1652–1656, 2015

    2015

  22. [31]

    Classifying rdp remote attacks on user interfaces to industrial control systems,

    R. P. Ramirez et al., “Classifying rdp remote attacks on user interfaces to industrial control systems,” in 2022 International Conference on Computational Science and Computational Intelligence (CSCI). IEEE, 2022, pp. 870–875

    2022

  23. [32]

    Description and analysis of IEC 104 Protocol,

    P. Matou ˇsek, “Description and analysis of IEC 104 Protocol,” Faculty of Information Technology, Brno University o Technology, Tech. Rep , 2017

    2017

  24. [33]

    IEC 62351 Security Standards for the Power System Information Infrastructure,

    IEC, “IEC 62351 Security Standards for the Power System Information Infrastructure,” WG15, IEC TC57, Tech. Rep., 2016

    2016

  25. [34]

    Man-in-the-middle attack test-bed investigating cyber- security vulnerabilities in smart grid SCADA systems,

    Y . Yang et al., “Man-in-the-middle attack test-bed investigating cyber- security vulnerabilities in smart grid SCADA systems,” academia.edu, 2012

    2012

  26. [35]

    Madtls: Fine-grained Middlebox-aware End-to-end Security for Industrial Communication,

    E. Wagner et al., “Madtls: Fine-grained Middlebox-aware End-to-end Security for Industrial Communication,” in Proceedings of the 19th ACM ASIA Conference on Computer and Communications Security (ASIA CCS), 2024

    2024

  27. [36]

    Power Systems Management and Associated Information Ex- change – Data and Communications Security – Part 3: Communication Network and System Security – Profiles Including TCP/IP,

    IEC, “Power Systems Management and Associated Information Ex- change – Data and Communications Security – Part 3: Communication Network and System Security – Profiles Including TCP/IP,” IEC 62351-3, Tech. Rep., 2018

    2018

  28. [37]

    Secure links: Secure-by-design communications in iec 61499 industrial control applications,

    A. Tanveer et al. , “Secure links: Secure-by-design communications in iec 61499 industrial control applications,” IEEE Transactions on Industrial Informatics, 2020

    2020

  29. [38]

    Securing IEC 60870-5-104 communications following IEC 62351 standard: lab tests and results,

    M. G. Todeschini et al., “Securing IEC 60870-5-104 communications following IEC 62351 standard: lab tests and results,” in AEIT. IEEE, 2020

    2020

  30. [39]

    Legacy-compliant data authentication for industrial control system traffic,

    J. H. Castellanos et al. , “Legacy-compliant data authentication for industrial control system traffic,” in ACNS. Springer, 2017

    2017

  31. [40]

    A survey on smart grid cyber-physical system testbeds,

    M. H. Cintuglu et al., “A survey on smart grid cyber-physical system testbeds,” IEEE Communications Surveys & Tutorials , vol. 19, no. 1, pp. 446–464, 2016

    2016

  32. [41]

    A framework for modeling cyber-physical switching attacks in smart grid,

    S. Liu et al. , “A framework for modeling cyber-physical switching attacks in smart grid,” IEEE Transactions on Emerging Topics in Computing, vol. 1, no. 2, pp. 273–285, 2013

    2013

  33. [42]

    A comprehensive survey on network anomaly detection,

    G. Fernandes et al. , “A comprehensive survey on network anomaly detection,” Telecommunication Systems, 2019

    2019

  34. [43]

    Intrusion detection and big heterogeneous data: a survey,

    R. Zuech et al. , “Intrusion detection and big heterogeneous data: a survey,” Journal of Big Data , 2015

    2015

  35. [44]

    A simple and efficient hidden markov model scheme for host-based anomaly intrusion detection,

    J. Hu et al., “A simple and efficient hidden markov model scheme for host-based anomaly intrusion detection,” IEEE network, 2009

    2009

  36. [45]

    A survey of network-based intrusion detection data sets,

    M. Ring et al. , “A survey of network-based intrusion detection data sets,” Computers & Security , 2019

    2019

  37. [46]

    SoK: Evaluations in Industrial Intrusion Detection Research,

    O. Lamberts et al., “SoK: Evaluations in Industrial Intrusion Detection Research,” Journal of Systems Research , vol. 3, no. 1, 2023

    2023

  38. [48]

    Zhou, Ensemble methods: foundations and algorithms

    Z.-H. Zhou, Ensemble methods: foundations and algorithms . CRC press, 2012

    2012

  39. [49]

    Introducing a Comprehensive, Continuous, and Collaborative Survey of Intrusion Detection Datasets,

    P. B ¨onninghausen et al. , “Introducing a Comprehensive, Continuous, and Collaborative Survey of Intrusion Detection Datasets,” in Proceed- ings of the 17th Cyber Security Experimentation and Test Workshop (CSET), 2024

    2024

  40. [50]

    Pmlb: a large benchmark suite for machine learning evaluation and comparison,

    R. S. Olson et al., “Pmlb: a large benchmark suite for machine learning evaluation and comparison,” BioData mining, 2017

    2017

  41. [51]

    Scientific machine learning benchmarks,

    J. Thiyagalingam et al. , “Scientific machine learning benchmarks,” Nature Reviews Physics , 2022

    2022

  42. [52]

    Ics cyber attack detection with ensemble machine learning and dpi using cyber-kit datasets,

    S. Mubarak et al., “Ics cyber attack detection with ensemble machine learning and dpi using cyber-kit datasets,” in IEEE ICCCE, 2021

    2021

  43. [53]

    Evaluating real-time anomaly detection algorithms– the numenta anomaly benchmark,

    A. Lavin et al. , “Evaluating real-time anomaly detection algorithms– the numenta anomaly benchmark,” in 2015 IEEE 14th international conference on machine learning and applications (ICMLA) . IEEE, 2015, pp. 38–44

    2015

  44. [54]

    Evaluation of machine learning algorithms for anomaly detection in industrial networks,

    G. Bernieri et al. , “Evaluation of machine learning algorithms for anomaly detection in industrial networks,” in IEEE M&N, 2019

    2019

  45. [55]

    Validating anomaly detection mechanisms in industrial control systems,

    S. Liyakkathali et al. , “Validating anomaly detection mechanisms in industrial control systems,” in Proceedings of TMCE , 2020

    2020

  46. [56]

    Benchmark of machine learning al- gorithms on capturing future distribution network anomalies,

    M. Mohammadpourfard et al. , “Benchmark of machine learning al- gorithms on capturing future distribution network anomalies,” IET Generation, Transmission & Distribution , 2019

    2019

  47. [57]

    Why question machine learning evaluation methods,

    N. Japkowicz, “Why question machine learning evaluation methods,” in AAAI workshop on evaluation methods for machine learning , 2006

    2006

  48. [58]

    Anomaly-based intrusion detection by machine learn- ing: A case study on probing attacks to an institutional network,

    E. Tufan et al., “Anomaly-based intrusion detection by machine learn- ing: A case study on probing attacks to an institutional network,” IEEE Access, 2021

    2021

  49. [59]

    The industrial control system cyber defence triage process,

    A. Cook et al. , “The industrial control system cyber defence triage process,” Computers & Security , 2017

    2017

  50. [60]

    Process-aware model based IDSs for industrial control systems cybersecurity: approaches, limits and further research,

    C. Escudero et al. , “Process-aware model based IDSs for industrial control systems cybersecurity: approaches, limits and further research,” in ETFA. IEEE, 2018

    2018

  51. [61]

    A specification-based state replication approach for digital twins,

    M. Eckhart et al., “A specification-based state replication approach for digital twins,” in CPS-SPC, 2018

    2018

  52. [62]

    Distributed intrusion detection system using semantic-based rules for scada in smart grid,

    S. N. Mohan et al. , “Distributed intrusion detection system using semantic-based rules for scada in smart grid,” in T&D. IEEE, 2020

    2020

  53. [63]

    Efficient modelling of ics communication for anomaly detection using probabilistic automata,

    P. Matou ˇsek et al. , “Efficient modelling of ics communication for anomaly detection using probabilistic automata,” in IM. IEEE, 2021

    2021

  54. [64]

    Fuzzy automaton as a detection mechanism for the multi-step attack,

    M. Almseidin et al., “Fuzzy automaton as a detection mechanism for the multi-step attack,” IJASEIT, 2019

    2019

  55. [65]

    An anomaly detection mechanism for IEC 60870-5-104,

    P. R. Grammatikis et al. , “An anomaly detection mechanism for IEC 60870-5-104,” in MOCAST. IEEE, 2020

    2020

  56. [66]

    Anomaly Detection of ICS Communication Using Statistical Models,

    I. Burgetov ´a et al., “Anomaly Detection of ICS Communication Using Statistical Models,” in CNSM. IEEE, 2021

    2021

  57. [67]

    A Comparison of Unsupervised Learning Algorithms for Intrusion Detection in IEC 104 SCADA Protocol,

    M. Anwar et al., “A Comparison of Unsupervised Learning Algorithms for Intrusion Detection in IEC 104 SCADA Protocol,” in ICMLC. IEEE, 2021

    2021

  58. [68]

    Status of the National Implementation of the NC RfG in Germany,

    F. Scheben et al. , “Status of the National Implementation of the NC RfG in Germany,” in NEIS Conference 2016 . Springer, 2017

    2016

  59. [69]

    Improving the performance of the intrusion detection systems by the machine learning explainability,

    Q.-V . Dang, “Improving the performance of the intrusion detection systems by the machine learning explainability,” International Journal of Web Information Systems , 2021

    2021

  60. [70]

    Measuring the quality of explanations: the system causability scale (SCS),

    A. Holzinger et al., “Measuring the quality of explanations: the system causability scale (SCS),” KI-K¨unstliche Intelligenz, 2020

    2020

  61. [71]

    Toward generating a new intrusion detection dataset and intrusion traffic characterization

    I. Sharafaldin et al. , “Toward generating a new intrusion detection dataset and intrusion traffic characterization.” ICISSp, 2018

    2018

  62. [72]

    On generating network traffic datasets with synthetic attacks for intrusion detection,

    C. G. Cordero et al. , “On generating network traffic datasets with synthetic attacks for intrusion detection,” ACM TOPS, 2021

    2021

  63. [73]

    Gan-based data generation approach for ids: Evaluation on decision tree,

    S. K. Pandey et al. , “Gan-based data generation approach for ids: Evaluation on decision tree,” in AISC: V14, 2021

    2021

  64. [74]

    Melody: synthesized datasets for evaluating intrusion detection systems for the smart grid,

    V . Babu et al., “Melody: synthesized datasets for evaluating intrusion detection systems for the smart grid,” in WSC, 2017

    2017

  65. [75]

    Deep reinforcement learning for cyber system defense under dynamic adversarial uncertainties,

    A. Dutta et al. , “Deep reinforcement learning for cyber system defense under dynamic adversarial uncertainties,” arXiv preprint arXiv:2302.01595, 2023

    2023 arXiv

  66. [76]

    Implementation aspects of smart grids cyber-security cross-layered framework for critical infrastructure operation,

    D. Agnew et al., “Implementation aspects of smart grids cyber-security cross-layered framework for critical infrastructure operation,” Applied Sciences, 2022

    2022

  67. [77]

    Reproducible and Adaptable Log Data Generation for Sound Cybersecurity Experiments,

    R. Uetz et al., “Reproducible and Adaptable Log Data Generation for Sound Cybersecurity Experiments,” in Proceedings of the 37th Annual Computer Security Applications Conference (ACSAC) , 2021

    2021

  68. [78]

    Challenges and Pitfalls in Generating Representative ICS Datasets in Cyber Security Research,

    A. Mitseva et al., “Challenges and Pitfalls in Generating Representative ICS Datasets in Cyber Security Research,” in European Symposium on Research in Computer Security (ESORICS) . Springer, 2022, pp. 379– 397

    2022

  69. [79]

    Real-time simulation with opal-rt technologies and applications for control and protection schemes in electrical net- works

    E. G ´omez-Luna et al., “Real-time simulation with opal-rt technologies and applications for control and protection schemes in electrical net- works.” Journal of Engineering Science & Technology Review, vol. 12, no. 3, 2019

    2019

  70. [80]

    Testing and validation of power system dynamic state estimators using real time digital simulator (rtds),

    A. Sharma et al. , “Testing and validation of power system dynamic state estimators using real time digital simulator (rtds),” IEEE Trans- actions on Power Systems , vol. 31, no. 3, pp. 2338–2347, 2015

    2015

  71. [81]

    Real-time simulation models for photovoltaic cells and arrays in opal-rt and typhoon-hil,

    X. Jia et al., “Real-time simulation models for photovoltaic cells and arrays in opal-rt and typhoon-hil,” in 2020 IEEE Power & Energy Society General Meeting (PESGM) . IEEE, 2020, pp. 1–5

    2020

  72. [82]

    Comparison between two co-simulation frame- works, mosaik and helics,

    J. G. Rueda Vasquez, “Comparison between two co-simulation frame- works, mosaik and helics,” Ph.D. dissertation, Politecnico di Torino, 2022

    2022

  73. [83]

    Co-simulator of power and communication networks using opendss and omnet++,

    G. O. Troiano et al. , “Co-simulator of power and communication networks using opendss and omnet++,” in 2016 IEEE Innovative Smart Grid Technologies-Asia (ISGT-Asia). IEEE, 2016, pp. 1094–1099

    2016

  74. [84]

    Cyber-physical co-simulation of smart grid ap- plications using ns-3,

    M. U. Tariq et al. , “Cyber-physical co-simulation of smart grid ap- plications using ns-3,” in Proceedings of the 2014 Workshop on ns-3 , 2014, pp. 1–8

    2014

  75. [85]

    Co-simulation platform for smart grid applica- tions,

    B. Amarasekara et al., “Co-simulation platform for smart grid applica- tions,” in 2015 IEEE Innovative Smart Grid Technologies-Asia (ISGT ASIA). IEEE, 2015, pp. 1–6

    2015

  76. [86]

    Network and power-grid co-simulation framework for smart grid wide-area monitoring networks,

    D. Bhor et al., “Network and power-grid co-simulation framework for smart grid wide-area monitoring networks,” Journal of Network and Computer Applications, vol. 59, pp. 274–284, 2016

    2016

  77. [87]

    Combining simulation and emulation systems for smart grid planning and evaluation,

    C. Hannon et al. , “Combining simulation and emulation systems for smart grid planning and evaluation,” ACM Transactions on Modeling and Computer Simulation (TOMACS) , vol. 28, no. 4, pp. 1–23, 2018

    2018

  78. [88]

    Real-time co-simulation platform using opal-rt and opnet for analyzing smart grid performance,

    D. Bian et al. , “Real-time co-simulation platform using opal-rt and opnet for analyzing smart grid performance,” in 2015 IEEE Power & Energy Society General Meeting . IEEE, 2015, pp. 1–5

    2015

  79. [89]

    Development of the powercyber scada security testbed,

    A. Hahn et al. , “Development of the powercyber scada security testbed,” in Proceedings of the sixth annual workshop on cyber security and information intelligence research , 2010, pp. 1–4

    2010

  80. [90]

    Epochs: a platform for agent-based electric power and communication simulation built from commercial off-the-shelf components,

    K. Hopkinson et al., “Epochs: a platform for agent-based electric power and communication simulation built from commercial off-the-shelf components,” IEEE Transactions on Power Systems , vol. 21, no. 2, pp. 548–558, 2006

    2006

  81. [91]

    A Note on Two Problems in Connexion with Graphs,

    E. W. Dijkstra, “A Note on Two Problems in Connexion with Graphs,” Numerische Mathematik, vol. 1, pp. 269–271, 1959

    1959

  82. [92]

    Graph-based model of smart grid architectures,

    B. Klaer et al. , “Graph-based model of smart grid architectures,” in 2020 International conference on smart energy systems and technolo- gies (SEST). IEEE, 2020, pp. 1–6

    2020

  83. [93]

    Applying the smart grid architecture model for designing and validating system-of-systems in the power and energy domain: A european perspective,

    M. Uslar et al. , “Applying the smart grid architecture model for designing and validating system-of-systems in the power and energy domain: A european perspective,”Energies, vol. 12, no. 2, p. 258, 2019

    2019

  84. [94]

    Networkx: Network analysis with python,

    A. Hagberg et al. , “Networkx: Network analysis with python,” URL: https://networkx. github. io , 2020

    2020

  85. [95]

    pandapower—an open-source python tool for conve- nient modeling, analysis, and optimization of electric power systems,

    L. Thurner et al., “pandapower—an open-source python tool for conve- nient modeling, analysis, and optimization of electric power systems,” IEEE Transactions on Power Systems , vol. 33, no. 6, pp. 6510–6521, 2018

    2018

  86. [96]

    Luntovskyy et al., Moderne Rechnernetze

    A. Luntovskyy et al., Moderne Rechnernetze. Springer, 2020

    2020

  87. [97]

    IEEE Standard for Ethernet,

    “IEEE Standard for Ethernet,” IEEE Std 802.3-2018 (Revision of IEEE Std 802.3-2015), pp. 1–5600, 2018

    2018

  88. [98]

    1– 3534, 2016

    “IEEE Standard for Information technology–Telecommunications and information exchange between systems Local and metropolitan area networks–Specific requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications,” IEEE Std 802.11-2016 (...

    2016

  89. [99]

    IEEE Standard for Information processing systems – Local area networks – Part 4: Standard for Token-Passing Bus Access Method and Physical Layer Specifications,

    “IEEE Standard for Information processing systems – Local area networks – Part 4: Standard for Token-Passing Bus Access Method and Physical Layer Specifications,” ANSI/IEEE Std 802.4-1990 (Revision of ANSI/IEEE 802.4-1985) (Adopted by ISO/IEC and redesignated as ISO/IEC 8802-4...

    1990

  90. [100]

    An ethernet address resolution protocol: Or converting network protocol addresses to 48.bit ethernet address for transmission on ethernet hardware,

    “An ethernet address resolution protocol: Or converting network protocol addresses to 48.bit ethernet address for transmission on ethernet hardware,” RFC 826, 1982. [Online]. Available: https://www.rfc-editor.org/info/rfc826

    1982

  91. [101]

    Internet protocol,

    “Internet protocol,” RFC 791, 1981. [Online]. Available: https: //www.rfc-editor.org/info/rfc791

    1981

  92. [102]

    Internet control message protocol,

    “Internet control message protocol,” RFC 792, 1981. [Online]. Available: https://www.rfc-editor.org/info/rfc792

    1981

  93. [103]

    Transmission control protocol,

    “Transmission control protocol,” RFC 793, 1981. [Online]. Available: https://www.rfc-editor.org/info/rfc793

    1981

  94. [104]

    User datagram protocol,

    “User datagram protocol,” RFC 768, 1980. [Online]. Available: https://www.rfc-editor.org/info/rfc768

    1980

  95. [105]

    A survey on the detection algorithms for false data injection attacks in smart grids,

    A. S. Musleh et al. , “A survey on the detection algorithms for false data injection attacks in smart grids,” IEEE Transactions on Smart Grid, vol. 11, no. 3, pp. 2218–2234, 2019

    2019

  96. [106]

    Distribution grid state estimation from compressed measurements,

    S. S. Alam et al., “Distribution grid state estimation from compressed measurements,” IEEE Transactions on Smart Grid , vol. 5, no. 4, pp. 1631–1642, 2014

    2014

  97. [107]

    Smart congestion management in active distribution net- works,

    A. Haque, “Smart congestion management in active distribution net- works,” research.tue.nl, 2017

    2017

  98. [108]

    Analysis of operational sequences for conges- tion management measures in transmission grids,

    M. Schneider et al. , “Analysis of operational sequences for conges- tion management measures in transmission grids,” in 2020 6th IEEE International Energy Conference (ENERGYCon) . IEEE, 2020, pp. 621–624

    2020

  99. [109]

    Greedy algorithms for minimum spanning tree,

    H. J. Greenberg, “Greedy algorithms for minimum spanning tree,” University of Colorado at Denver , 1998

    1998

  100. [110]

    An approach to abstract multi-stage cyberattack data generation for ml-based ids in smart grids,

    ¨O. Sen et al. , “An approach to abstract multi-stage cyberattack data generation for ml-based ids in smart grids,” in 2023 IEEE Belgrade PowerTech. IEEE, 2023, pp. 01–10

    2023

  101. [111]

    Mitre att&ck for industrial control systems: Design and philosophy,

    O. Alexander et al. , “Mitre att&ck for industrial control systems: Design and philosophy,” The MITRE Corporation: Bedford, MA, USA , vol. 29, 2020

    2020

  102. [112]

    Ukraine cyber-induced power outage: Analysis and practical mitigation strategies,

    D. E. Whitehead et al., “Ukraine cyber-induced power outage: Analysis and practical mitigation strategies,” in 2017 70th Annual conference for protective relay engineers (CPRE) . IEEE, 2017, pp. 1–8

    2017

  103. [113]

    D. E. Capano, “Understand the cyber-attack lifecycle: A cyber kill chain provides a model for understanding the lifecycle of a cyber attack and helps those involved with critical infrastructure improve cybersecurity policies, technologies, training, and industrial control syst...

    2019

  104. [114]

    Mulval: A logic-based network security analyzer

    X. Ou et al. , “Mulval: A logic-based network security analyzer.” in USENIX, 2005

    2005

  105. [115]

    Economic impacts of cyber security in energy sector: A review,

    S. K. Venkatachary et al. , “Economic impacts of cyber security in energy sector: A review,” International Journal of Energy Economics and Policy, vol. 7, no. 5, pp. 250–262, 2017

    2017

  106. [116]

    Stuxnet,

    M. Baezner et al., “Stuxnet,” ETH Zurich, Tech. Rep., 2017

    2017

  107. [117]

    On using contextual correlation to detect multi-stage cyber attacks in smart grids,

    ¨O. Sen et al. , “On using contextual correlation to detect multi-stage cyber attacks in smart grids,” Sustainable Energy, Grids and Networks, vol. 32, p. 100821, 2022

    2022

  108. [118]

    False data injection attacks against state estimation in electric power grids,

    Y . Liu et al. , “False data injection attacks against state estimation in electric power grids,” ACM Transactions on Information and System Security (TISSEC), vol. 14, no. 1, pp. 1–33, 2011

    2011

  109. [119]

    Machine learning made easy: a review of scikit-learn package in python programming language,

    J. Hao et al. , “Machine learning made easy: a review of scikit-learn package in python programming language,” Journal of Educational and Behavioral Statistics, vol. 44, no. 3, pp. 348–361, 2019

    2019

  110. [120]

    A game theoretic approach to cyber security risk management,

    S. Musman et al. , “A game theoretic approach to cyber security risk management,” JDMS, 2018

    2018

  111. [121]

    Mitre att&ck: Design and philosophy,

    B. E. Strom et al., “Mitre att&ck: Design and philosophy,” in Technical report, 2018

    2018

  112. [122]

    Toward a knowledge graph of cybersecurity countermeasures,

    P. E. Kaloroumakis et al., “Toward a knowledge graph of cybersecurity countermeasures,” MITRE, 2021

    2021

  113. [123]

    A review of cyber security risk assessment methods for scada systems,

    Y . Cherdantseva et al. , “A review of cyber security risk assessment methods for scada systems,” Computers & security , 2016

    2016

  114. [124]

    The β-time-to-compromise metric for practical cyber security risk estimation,

    A. Zieger et al., “The β-time-to-compromise metric for practical cyber security risk estimation,” in IMF. IEEE, 2018

    2018

  115. [125]

    The purdue enterprise reference architecture,

    T. J. Williams, “The purdue enterprise reference architecture,” Com- puters in industry , 1994

    1994

  116. [126]

    A novel hybrid approach to estimate customer interruption costs for industry sectors,

    K. Sinan et al. , “A novel hybrid approach to estimate customer interruption costs for industry sectors,” Engineering, 2013

    2013

  117. [127]

    Investigating man-in-the-middle-based false data in- jection in a smart grid laboratory environment,

    ¨O. Sen et al. , “Investigating man-in-the-middle-based false data in- jection in a smart grid laboratory environment,” in 2021 IEEE PES Innovative Smart Grid Technologies Europe (ISGT Europe) . IEEE, 2021, pp. 01–06

    2021

  118. [128]

    Multi-stage analysis of intrusion detection logs for quick impact assessment,

    H. Au et al., “Multi-stage analysis of intrusion detection logs for quick impact assessment,” in ECIW, 2016

    2016

  119. [129]

    Performance analysis of machine learning algorithms in intrusion detection system: A review,

    T. Saranya et al., “Performance analysis of machine learning algorithms in intrusion detection system: A review,” Procedia Computer Science , 2020

    2020

  120. [130]

    Evaluating synthetic datasets for training machine learning models to detect malicious commands,

    J. W. Teo et al. , “Evaluating synthetic datasets for training machine learning models to detect malicious commands,” in SmartGridComm. IEEE, 2022

    2022

  121. [131]

    Investigating the statistical assumptions of na¨ıve bayes classifiers,

    A. Kelly et al., “Investigating the statistical assumptions of na¨ıve bayes classifiers,” in CISS. IEEE, 2021

    2021

  122. [132]

    Machine learning and deep learning methods for intrusion detection systems: A survey,

    H. Liu et al. , “Machine learning and deep learning methods for intrusion detection systems: A survey,” applied sciences, 2019

    2019

  123. [133]

    Exploiting attack–defense trees to find an optimal set of countermeasures,

    B. Fila et al., “Exploiting attack–defense trees to find an optimal set of countermeasures,” in 2020 IEEE 33rd Computer Security Foundations Symposium (CSF). IEEE, 2020, pp. 395–410

    2020

  124. [134]

    Generalized sobol sensitivity indices for dependent variables: numerical methods,

    G. Chastaing et al., “Generalized sobol sensitivity indices for dependent variables: numerical methods,” Journal of statistical computation and simulation, vol. 85, no. 7, pp. 1306–1333, 2015

    2015

  125. [135]

    An integrated framework for the methodological assurance of security and privacy in the development and operation of multicloud applications,

    E. R ´ıos Velasco, “An integrated framework for the methodological assurance of security and privacy in the development and operation of multicloud applications,” addi.ehu.es: TD-Ingenier´ıa y Arquitectura, 2020

    2020

  126. [136]

    It risk management based on iso 31000 and owasp framework using osint at the information gathering stage (case study: X company),

    A. A. B. A. Wiradarma et al., “It risk management based on iso 31000 and owasp framework using osint at the information gathering stage (case study: X company),” International Journal of Computer Network and Information Security , vol. 10, no. 12, p. 17, 2019

    2019

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.