Smart grids are increasingly exposed to sophisticated cyber threats due to their reliance on interconnected communication networks, as demonstrated by real world incidents such as the cyberattacks on the Ukrainian power grid. In IEC61850 based smart substations, the Manufacturing Message Specification protocol operates over TCP to facilitate communication between SCADA systems and field devices such as Intelligent Electronic Devices and Programmable Logic Controllers. Although MMS enables efficient monitoring and control, it can be exploited by adversaries to generate legitimate looking packets for reconnaissance, unauthorized state reading, and malicious command injection, thereby disrupting grid operations. In this work, we propose a fully automated attack detection and prevention framework for IEC61850 compliant smart substations to counter remote cyberattacks that manipulate process states through compromised PLCs and IEDs. A detailed analysis of the MMS protocol is presented, and critical MMS field value pairs are extracted during both normal SCADA operation and active attack conditions. The proposed framework is validated using seven datasets comprising benign operational scenarios and multiple attack instances, including IEC61850Bean based attacks and script driven attacks leveraging the libiec61850 library. Our approach accurately identifies attack signature carrying MMS packets that attempt to disrupt circuit breaker status, specifically targeting the smart home zone IED and PLC of the EPIC testbed. The results demonstrate the effectiveness of the proposed framework in precisely detecting malicious MMS traffic and enhancing the cyber resilience of IEC61850 based smart grid environments.

This work provides a detailed specification of the Smart Grid Modelling Language (SG-ML), which is designed for the automated generation of smart grid cyber ranges. SG-ML is defined as a set of XML schemas that describe a smart grid's configuration in both machine-readable and human-friendly ways, thereby bridging the gap between system modelling and automated deployment. Unlike prior ad-hoc approaches to cyber range design, SG-ML provides a unified methodology that integrates both power system and cyber network representations. The SG-ML model can be customized by users to meet specific requirements, such as emulating physical or cyber topologies and configuring network devices. An SG-ML Processor then parses this configured model to instantiate the cyber range environment. The modelling language leverages established standards like the IEC 61850 Substation Configuration Language (SCL) and IEC 61131 PLCopen XML to define power system topology, cyber network topology, and device configurations. This approach allows for the reuse of existing assets, reducing the effort needed to create the SG-ML model. To address gaps not covered by these standards such as attack injection parameters, scenario-specific metadata, and additional network constraints, SG-ML introduces proprietary schemas that complement standard models. Overall, SG-ML enables reproducible, scalable, and automated generation of realistic smart grid cyber ranges for research, training, and security assessment.

Industrial Control Systems (ICSs) face growing exposure to cyberattacks due to increasing interconnectivity and continued digitization. Effective protection from these threats requires well-designed security policies that are adapted to the target system’s unique operating environment. However, security policy development remains manual and error-prone, constrained by system complexity and the need for specialized technical expertise. To address these limitations, this paper presents AutoPGT, an Automated Policy Generation Tool that produces security policy code based on natural language descriptions and system data. The tool uses Large Language Models (LLMs) to first generate reusable system-agnostic policy templates from user descriptions, and then combines them with system data to produce system-specific policy code. We evaluate AutoPGT by gauging the alignment between its drafted policies and the original user intent under different generation configurations. Our results show that including representative examples and requiring the model to justify its choices yields stronger alignment between generated policies and user intent. Given these findings, AutoPGT enables the development of intuitive and robust security policies that strengthen the resilience of critical cyber-physical systems.

In this demo paperwe discuss and present a configurable, extensible, reproducible, scalable and instrumentable smart grid cyber range that was used in a real-world capture-the-flag competition event.

The 7th Joint Workshop on CPS & IoT Security and Privacy is set to take place in Taipei, Taiwan, on October 17, 2025, in conjunction with the ACM Conference on Computer and Communications Security (CCS'25). This workshop marks the amalgamation of two workshops held in 2019: one focused on the security and privacy of cyber-physical systems, while the other one centered on the security and privacy of IoT. The primary objective of this workshop is to create a collaborative forum that brings together academia, industry experts, and governmental entities, encouraging them to contribute cutting-edge research, share demonstrations or hands-on experiences, and engage in discussions. This year, our call for contributions encompassed a broad spectrum, including full research papers, work-in-progress submissions, and one-page abstracts. The workshop program includes nine full/short papers on the security and privacy of CPS/IoT, alongside one demo paper that presents a virtual cybersecurity testbed. Furthermore, the workshop will feature one distinguished keynote presentation by Prof. Daniel Xiapu Luo, a world-renowned expert in CPS security. The talk will offer deep insights on automotive cybersecurity. The complete CPSIoTSec'25 workshop proceedings are available at https://doi.org/10.1145/3733801.

Moving target defense (MTD) in power grids is an emerging defense technique that has gained prominence in the recent past. It aims to solve the long-standing problem of securing the power grid against stealthy attacks. The key idea behind MTD is to introduce periodic/event-triggered controlled changes to the power grid's SCADA network/physical plant, thereby invalidating the knowledge attackers use for crafting stealthy attacks. In this paper, we provide a comprehensive overview of this topic and classify the different ways in which MTD is implemented in power grids. We further introduce the guiding principles behind the design of MTD, key performance metrics, and the associated trade-offs in MTD and identify the future development of MTD for power grid security.

Digitalization of power grids have made them increasingly susceptible to cyber-attacks in the past decade. Iterative cybersecurity testing (i.e., red-team testing or penetration testing) is indispensable to counter emerging attack vectors and to ensure dependability of critical infrastructure. Furthermore, these can be used to evaluate cybersecurity configuration, effectiveness of the cybersecurity measures against various attack vectors, and to train smart grid cybersecurity experts defending the system. Facilitating extensive experiments narrows the gap between academic research and production environment. A high-fidelity cyber range (a virtual cybersecurity testbed emulating smart grid systems) is vital as it is often infeasible to conduct such experiments and training using production environment. However, the design and implementation of cyber range requires extensive domain knowledge of physical and cyber aspect of the infrastructure. Furthermore, costs incurred for setup and maintenance of cyber range are significant. Moreover, most existing smart grid cyber ranges are designed as a one-off, proprietary system, and are limited in terms of configurability, accessibility, portability, and reproducibility. To address these challenges, an automated smart grid cyber range generation framework (Auto-SGCR) is presented in this article. Initially a human-/machine-friendly, XML-based modeling language called smart grid modeling language (SG-ML) was defined, which incorporates IEC 61850 system configuration language files. Subsequently, a tool chain to parse SG-ML model files and automatically instantiate a functional smart grid cyber range was developed. The developed SG-ML models can be easily shared and/or modified to reproduce or customize for any cyber range. The application of Auto-SGCR is demonstrated through case studies with large-scale substation models. The toolchain along with example SG-ML models have been open-sourced.

Honeypots are valuable tools for collecting real-world attack data and threat intelligence, and a network of honeypots, also called honeynet, further allows us to observe attackers’ behavior after their penetration into the infrastructure. Yet, designing and implementing high-fidelity honeynets for smart grid systems remains challenging. Besides the scarcity of available implementations, most of the honeypots available for smart grid offer imitation of a single device (e.g., PLC), and the setup of such devices in a desired topology requires a significant amount of manual configuration efforts. To address the challenge, this paper presents the first-of-its-kind framework for automated instantiation of operational smart-grid honeynets based on user-provided configurations, by extending the automated cyber range generation toolchains, called SG-ML. The developed framework not only facilitates the development of high-fidelity smart grid honeynets but also operation of such honeypot, such as re-configuration and restoration. Our framework integrates and orchestrates configuration of multiple open-source tools, such as Honeyd and HoneyPLC, according to user preferences, for deception. Moreover, multiple communication protocols, Modbus, OPC UA, Siemens S7comm, in addition to IEC 61850, are supported for flexibility. We also tackle a challenge on systematic evaluation of smart grid honeynets. In this direction, in addition to conducting qualitative assessment based on the established taxonomy of fingerprinting tactics, we further develop a toolchain on MITRE Caldera platform for evaluating the deception and logging capabilities of smart grid honeypots/honeynets. The honeynet generation framework and evaluation toolchain will be open-sourced for smart grid R&D community.

Intrusion Detection Systems (IDSes) are key defense mechanisms for securing smart grids against cyberattacks. They require realistic datasets to develop accurate models for detecting network anomalies. However, acquiring realistic datasets is challenging due to the need for expert knowledge to accurately label attack data, the sensitive nature of the information, and safety issues related to attacking the actual power systems. Consequently, there is a lack of high-fidelity datasets for testing and validating the efficacy of IDSes. While synthetic datasets provide a good workaround, they are often unrealistic and fail to capture the physical dynamics of power systems under cyberattacks. To address this gap, we leverage the Electric Power and Intelligent Control (EPIC) testbed, a hardware-based smart grid security testbed, to simulate false data injection attacks (FDIA) and time delay attacks (TDA) on two critical power grid operations, namely generator synchronization and reverse power prevention. Our goal is to generate representative datasets that accurately model those operations under normal and attack conditions. By making these datasets publicly available, we enable the research community to develop more effective IDS solutions to enhance the security of smart grids.

Smart grid systems, along with other modernized critical infrastructures, have been targeted by cyber attackers in recent years. This has surged the demand for research and development of cybersecurity technologies to defend them as well as for training of cybersecurity experts. Cyber range, which is a virtual environment imitating the configuration and behaviours of real system infrastructure, is a solution to address them. While there are multiple efforts devoted to develop a cyber range of smart grid systems, we still face challenges in terms of configurability, accessibility, scalability, reproducibility, and initial/operational cost. In this paper, we propose smart grid Cyber Range as a Service (CRaaS), which provides a framework to facilitate the automated instantiation and usage of a smart grid cyber range on an OpenStack cloud platform to address these challenges. To demonstrate the feasibility, we conduct implementation study of a functional prototype on National Cybersecurity Research and Development Lab in Singapore.

Programmable logic controllers (PLCs) are crucial devices for implementing automated control in various industrial control systems (ICS), such as smart power grids, water treatment systems, manufacturing, and transportation systems. Owing to their importance, PLCs are often the target of cyber attackers that are aiming at disrupting the operation of ICS, including the nation's critical infrastructure, by compromising the integrity of control logic execution. While a wide range of cybersecurity solutions for ICS have been proposed, they cannot counter strong adversaries with a foothold on the PLC devices, which could manipulate memory, I/O interface, or PLC logic itself. These days, many ICS devices in the market, including PLCs, run on ARM-based processors, and there is a promising security technology called ARM TrustZone, to offer a Trusted Execution Environment (TEE) on embedded devices. Envisioning that such a hardware-assisted security feature becomes available for ICS devices in the near future, this paper investigates the application of the ARM TrustZone TEE technology for enhancing the security of PLC. Our aim is to evaluate the feasibility and practicality of the TEE-based PLCs through the proof-of-concept design and implementation using open-source software such as OP-TEE and OpenPLC. Our evaluation assesses the performance and resource consumption in real-world ICS configurations, and based on the results, we discuss bottlenecks in the OP-TEE secure OS towards a large-scale ICS and desired changes for its application on ICS devices. Our implementation is made available to public for further study and research.

Successful attacks against industrial control systems (ICSs) often exploit insufficient checking mechanisms. While firewalls, intrusion detection systems, and similar appliances introduce essential checks, their efficacy depends on the attackers’ ability to bypass such middleboxes. We propose a provenance solution to enable the verification of an end-to-end message delivery path and the actions performed on a message. Fast and flexible provenance verification (F2-Pro) provides cryptographically verifiable evidence that a message has originated from a legitimate source and gone through the necessary checks before reaching its destination. F2-Prorelies on lightweight cryptographic primitives and flexibly supports various communication settings and protocols encountered in ICS thanks to its transparent, bump-in-the-wire design. We provide formal definitions and cryptographically prove F2-Pro’s security. For human interaction with ICS via a field service device, F2-Profeatures a multi-factor authentication mechanism that starts the provenance chain from a human user issuing commands. We compatibility tested F2-Proon a smart power grid testbed and reported a sub-millisecond latency overhead per communication hop using a modest ARM Cortex-A15 processor.

Modern energy grids employ network-enabled sensors, meters, and actuators, controlled via a bidirectional flow of information facilitated by communication and networking infrastructure. The increase in information and communication technologies has, however, rendered smart grids vulnerable to cyberattacks. This position paper presents an ontological model of smart grid systems that elucidates the entities involved and their interrelationships, enabling systematic identification of attack surfaces and vectors. We augment this model by providing an automated method to integrate the vulnerabilities in the Common Vulnerabilities and Exposures (CVE) database – an expanding catalog of over 200,000 cybersecurity vulnerabilities maintained by the MITRE Corporation – to the specified smart grid components in the ontology. By populating the ontology with relevant CVE database entries, we provide an enriched understanding that guides vulnerability assessment and security policy design in smart grid systems. Furthermore, we introduce an automation framework to generate security policies, leveraging the machine-readability of our ontology. This research is expected to promote collaboration among various stakeholders, ranging from developers and operators to regulators, fostering enhanced smart grid security.

The increasing use of information and communication technologies has led to increasing threats on critical infrastructure like smart grids. Owing to confidentiality issues and difficulties in experimenting cyberattacks on a real environment, testbeds reflecting the characteristics of smart grids have been developed to enable attack experiments and cybersecurity research. In fact, different implementations of smart grid testbeds exist, each with its own challenges and limitations. The comparative study we present here justifies the usability of each type of testbed for different experiments. We begin our study with a selection of state-of-the-art smart grid testbeds, which can be classified into physical, hybrid, and virtual. We then present an evaluation based upon several qualitative metrics and MITRE ATT&CK matrix to demonstrate the coverage of all tactics and techniques to guide about the selection of testbed according to security needs. Finally, we explain applicable tactics and techniques for one of the testbeds through an attack case study to highlight current cybersecurity challenges faced by smart grids.

Cyber-physical systems (CPSs) are monitored and controlled by a computing and communicating core. This cyber layer enables better management of the controlled subsystem, but it also introduces threats to the security and protection of CPSs, as demonstrated by recent cyberattacks. The resulting governance and policy emphasis on cybersecurity is reflected in the academia by a vast body of literature. In this article, we systematize existing knowledge on CPS analysis. Specifically, we focus on the quantitative assessment of CPSs before and after the occurrence of a disruption. Through the systematic analysis of the models and methods adopted in the literature, we develop a CPS resilience assessment framework consisting of three steps, namely, (1) CPS description, (2) disruption scenario identification, and (3) resilience strategy selection. For each step of the framework, we suggest established methods for CPS analysis and suggest four criteria for method selection. The framework proposes a standardized workflow to assess the resilience of CPSs before and after the occurrence of a disruption. The application of the proposed framework is exemplified with reference to a power substation and associated communication network.The case study shows that the proposed framework supports resilience decision making by quantifying the effects of the implementation of resilience strategies.

Assurance of cybersecurity is crucial to ensure dependability and resilience of smart power grid systems. In order to evaluate the impact of potential cyber attacks, to assess deployability and effectiveness of cybersecurity measures, and to enable hands-on exercise and training of personals, an interactive, virtual environment that emulates the behaviour of a smart grid system, namely smart grid cyber range, has been demanded by industry players as well as academia. A smart grid cyber range is typically implemented as a combination of cyber system emulation, which allows interactivity, and physical system (i.e., power grid) simulation that are tightly coupled for consistent cyber and physical behaviours. However, its design and implementation require intensive expertise and efforts in cyber and physical aspects of smart power systems as well as software/system engineering. While many industry players, including power grid operators, device vendors, research and education sectors are interested, availability of the smart grid cyber range is limited to a small number of research labs. To address this challenge, we have developed a framework for modelling a smart grid cyber range using an XML-based language, called SG-ML, and for “compiling” the model into an operational cyber range with minimal engineering efforts. The modelling language includes standardized schema from IEC 61850 and IEC 61131, which allows industry players to utilize their existing configurations. The SG-ML framework aims at making a smart grid cyber range available to broader user bases to facilitate cybersecurity R&D and hands-on exercises.

Synchrophasor measurements play an important role in smart grid wide area protection. Recently, IEC 61850-90-5 has defined transmission of IEEE C37.118.1 synchrophasors over IEC 61850 messages. Routable versions of SV / GOOSE messages mapped to network and transport layers called R-SV / R-GOOSE have been proposed. This paper presents the performance evaluation of End-to-End (ETE) delays in R-SV / R-GOOSE messages exchanged for different wide area protection and control applications. The computational delays at publisher and subscriber are calculated using the C- based open-source framework for generating R-SV and R-GOOSE. The communication network delays are calculated by performing extensive communication network simulations using network simulation tools. Finally, the End-to-End (ETE) delay performance considering both computational and communication delays of R-SV and R-GOOSE messages for realizing different wide area control and protection applications (WAPC) are presented.

Due to the emerging cyber threats and the necessity to advance the security of smart grids, an environment to conduct intensive cyber security research is essential. Cyber security experiments on a real infrastructure is infeasible due to the practical complications and thereby, virtual testbeds are a viable solution. However, many of the existing solutions either rely on lower-fidelity power system simulator or high-end real-time simulation hardware, which is costly, and accessibility is limited. In this paper, a near-real-time, power system dynamics simulation, using Simulink, that can be integrated into a smart grid cyber range for interactive cyber security experiments is developed and explored as a solution. The interoperational control and data exchange with external components in the cyber range is achieved through TCP and low-latency in-memory database, respectively. Furthermore, Simulink parameters are calibrated in order to balance real-timeness and fidelity of dynamics simulation. Finally, cyberattack experiments are demonstrated using the developed interoperational simulator model.

Honeypots are a form of deception technology that provides an additional line of defense, and is regarded as a cybersecurity application of digital twins in the smart grid domain. By misleading attackers into a decoy and thereafter, performing threat intelligence collection and analysis, honeypots allow operators time to conceptualize mitigation strategies. In that regard, the most important property of a honeypot is realism from the attackers’ perspective, but the task of imitating the real system remains non-trivial, especially for smart grids which encompass immensely intricate infrastructures. The absence of an established way to guide the design of, or assess the effectiveness of smart grid honeypots, further compounds the problem. To supplement such research gaps, this paper first surveys existing literature on honeypot detection strategies, and thereafter, delineates a taxonomy of fingerprinting techniques geared towards smart grids. Such a taxonomy can be used to judge the realism of smart grid honeypots, and this paper demonstrates relevant evaluation applications after discussing our own implementation of a comprehensive smart grid honeypot. In essence, the aforementioned efforts are made to elucidate varied dimensions of smart grid honeypots’ realism and thereby provide an effective guide for the design of smart grid honeypots that are robust against fingerprinting.