The proposed testbed of the cyber‐power system consists of power system simulation, substation automation, and the SCADA system. Scenarios for substation cyber security intrusions and anomaly detection concepts have been proposed. An attack tree method can be used to identify vulnerable substations and intrusions through remote access points. Specific substation vulnerability scenarios have been tested. Temporal anomaly is determined by data and information acquired at different time points. This is a metric to determine the anomaly between two snapshots. In a distributed intrusion detection algorithm, distributed agents are trained with a large number of scenarios and intended for real‐time applications. In a distributed environment, if an anomaly is detected by one agent, it is able to distribute critical information to other agents in the network.@en