Cybersecurity issues have raised concerns as potential loopholes exist in the Supervisory Control And Data Acquisition (SCADA) system when the system architecture moved from a proprietary to an open system. As a result of the interdependency between the power grids and SCADA communication networks, it is important to further strengthen the defense of cyber networks against malicious intrusions. The focus of this research is to model and evaluate a novel cybersecurity protection scheme using network firewall technology operated at the application layer to enhance the information protection in SCADA networks. A quantitative analysis is performed based on the attack and defense simulations on the SCADA cybersecurity testbed available at UCD. The preliminary test results elucidate the effectiveness of the proposed scheme and demonstrate the feasibility of the proposed scheme for enhancing information security of the substations.@en

The proposed testbed of the cyber‐power system consists of power system simulation, substation automation, and the SCADA system. Scenarios for substation cyber security intrusions and anomaly detection concepts have been proposed. An attack tree method can be used to identify vulnerable substations and intrusions through remote access points. Specific substation vulnerability scenarios have been tested. Temporal anomaly is determined by data and information acquired at different time points. This is a metric to determine the anomaly between two snapshots. In a distributed intrusion detection algorithm, distributed agents are trained with a large number of scenarios and intended for real‐time applications. In a distributed environment, if an anomaly is detected by one agent, it is able to distribute critical information to other agents in the network.@en

On top of the power infrastructure reside information and communication technology (ICT) layers for monitoring and control of the grid. The cyber and power systems together form a complex structure, which is referred to as a cyber–physical system (CPS). If the power system's observability and controllability are compromised due to communication and cyber security problems, the grid can be exposed to catastrophic events. As a result, there is a great need to model the interactions between ICT and power grids. This paper proposes a new model and simulation platform for the supervisory control and data acquisition (SCADA) system of an integrated CPS. SCADA performance is assessed based on communication time delays. Methods to model cyber intrusions and assess the CPS security are proposed. The success rates for unauthorized access and control of power devices are computed. The impact on the grid is evaluated and the attack with the highest efficiency is identified. The proposed method is tested with the IEEE 39-bus system on a SCADA testbed. @en