To address cyber attacks targeting industrial control systems (ICSs), existing security measures are often restricted by a security-performance trade-off, reducing their deployability. This paper proposes I-DETECT, an in-network deep packet inspection framework that leverages high-performance P4-capable switches to analyze ICS traffic in real time. At its core is the Timed Event Accumulator (TEA), a new data structure that efficiently stores and aggregates time-stamped, continuous-valued measurements within the constraints of today’s programmable network hardware. Built on TEA, we, for the first time, realize complicated time-series analysis by using computational and storage units in network devices’ data and control planes. We evaluate I-DETECT in a cyber-physical testbed consisting of hardware P4 network switches, intelligent electronic devices from three vendors, and power system simulations driven by real operational data. Our results show that I-DETECT can implement seven security solutions for four different tasks, achieving 74.5–95.6% accuracy with negligible runtime overhead.

Grid-sensor networks, such as Phasor Measurement Units (PMU) systems, generate high-resolution, time-synchronized measurement data that are critical for detecting voltage and frequency disturbances. Conventional machine learning (ML) classification methods for detecting anomalous voltage events often rely on centralized processing, introducing latency that limits real-time responsiveness. In this work, we explore an in-network classification framework that leverages P4 programmability to support early classification of voltage events in synchrophasor data. We propose two complementary approaches: a data plane (DP)-driven approach that compiles ML logic directly into switch match-action tables for low-latency real-time classification, and a control plane (CP)-driven approach where parsed features by the network switch are exported for more accurate, although slightly higher-latency model inference. Using 27,000 PMU measurements from a campus microgrid, injected with 5% anomalous events, we evaluated multiple ML models, with the DP-and CP-driven approaches achieving on average 96% and 98% accuracy, respectively. Additionally, a hardware-based evaluation of the DP-driven approach using Intel’s Tofino programmable switch demonstrated processing latency between 577 and 610 nanoseconds. Our work illustrates the feasibility of leveraging P4 for real-time, in-network deployment of ML-based security analytics in smart-grid communications.

Phasor measurement unit (PMU) systems often experience unavoidable missing and erroneous measurements, which undermine power system observability and operational effectiveness. Traditional solutions for recovering missing PMU data employ a centralized approach at the control center, resulting in lengthy recovery times due to data transmission delays and processing overhead. In this paper, we leverage P4-based programmable networks to expedite missing data recovery. Our approach utilizes the data plane programmability offered by P4 to design an in-network solution for PMU data recovery. We establish a data-plane pipeline on P4 switches, featuring a customized PMU protocol parser, a missing data detection module, and an auto-regressive model for efficient data recovery. This methodology is implemented in a container-based network emulator and comprehensively evaluated using real PMU data from a campus microgrid. Our results indicate an end-to-end delivery and recovery time for missing packets of approximately 3.96 ms, sufficiently supporting most real-time applications reliant on PMU data. With a 5% packet loss rate, the mean absolute percentage error for voltage magnitude is a mere 0.04%, and the phase angle error typically hovers around 0.06 degrees, ensuring reliable data recovery.

Understanding the system responses to electric vehicle (EV) charging infrastructure expansion, including vehicle charging needs, station utilization, and energy consumption, is critical for effective planning to meet growing charging demand without unnecessary resource investment. This study evaluates the system responses to EV charging infrastructure expansion, focusing on charging needs, station utilization, and energy consumption. Using trip data from the National Household Travel Survey and origin-destination patterns, we simulated trip chains in downtown Atlanta with 10 % EV penetration. We assessed 32 scenarios involving different charging port power levels and siting strategies. We found that higher-power ports were more sensitive to placement, with concentrated expansion boosting station utilization more than uniform expansion. Adding high-power ports did not always increase peak energy consumption; in some cases, a few 400 kW ports reduced overall consumption compared to 150 kW ports by enabling faster charging and higher vehicle turnover.

This paper presents a review of physical and cyber threats reported in U.S substations. A comprehensive review of vulnerabilities associated with substation infrastructure, components, interfaces, and external communication network gateways was documented from standards and literature review. Physical and Cyber Security Attack types and their causes are captured, as well as how they can compromise the integrity of the substation. A simple tree-based logical solution with scenario probabilities is proposed to deploy countermeasures to thwart digital/physical threats for real-time awareness of attack vectors.

Industrial Control Systems (ICS) for power utilities often rely on legacy protocols like Modbus and DNP3 to transport control events and measurement data. These systems, however, are highly vulnerable to cyber-attacks due to the absence of basic security mechanisms in these legacy protocols and their increased integration with corporate networks and the Internet. Traditional approaches to securing ICS networks, such as using middle-boxes for IDS/IPS or securing protocols with authentication and encryption, often introduce significant overhead. In this paper, we propose an in-network security framework using programmable P4 data planes. Our framework performs detection and mitigation entirely in the data plane, addressing cross-domain security concerns such as traffic flow, packet structure, protocol violations, request message rates, and delayed or unsolicited responses. Additionally, to simplify management, we introduce a graph-based automated rule management module that streamlines table entry management on the P4 switch. Our evaluation on a Modbus TCP network using Intel's Tofino P4 switch demonstrates that programmable data planes can be effective in securing legacy ICS networks against a range of attacks, with minimal impact on forwarding delay and throughput.

Phasor Measurement Units (PMUs) provide time-synchronized, high-resolution measurements essential for real-time monitoring and control of modern power systems. However, PMU networks are vulnerable to data quality issues such as missing and delayed measurements, often caused by cyberattacks, synchronization failures, or hardware malfunctions. These disruptions can compromise cyber resilience for critical functions by degrading the accuracy of essential grid applications, including state estimation, fault detection, and stability assessment. To address this challenge, we present a decentralized, in-network PMU data recovery framework using P4-programmable switches. Our system detects and recovers missing and delayed data directly within the communication infrastructure, reducing dependency on centralized processing and enabling faster, more resilient responses. We implement the recovery scheme on P4 software switches and evaluate its performance using real-world PMU data from a campus microgrid. Results show that incorporating delayed data into the recovery process significantly improves accuracy, achieving a 20.69% reduction in magnitude mean absolute percentage error (MAPE) and a 28.6% reduction in average phase angle error. In the 5% missing PMU data scenario, the proposed approach maintains a low magnitude MAPE of 0.0279% and an average phase angle error of just 0.0272 degrees, demonstrating its effectiveness in improving data recovery accuracy.

It is essential to ensure that wide-area monitoring systems like Phasor Measurement Units (PMUs) remain resilient against attacks, especially when facing compromised devices, broken links, or faulty measurements. In this paper, we propose a self-healing scheme for PMU networks that employs switches with data-plane level programmability for quick recovery times. Upon detection of compromised devices or malicious data, the switches follow a three-phase approach that utilizes their decentralized processing power to restore observability with minimal latency. We utilize greedy algorithms and work alongside a centralized controller to gain further advantages in minimizing latency. We identify critical PMUs, compute new routes to Phasor Data Concentrators, and install those routes before identifying and fixing network issues, such as abnormally long paths, caused by the greedy algorithms. We verify our scheme with an IEEE 30-bus case study, and the results indicate that our approach is a viable real-time solution for PMU network self-healing.

Phasor Measurement Units (PMUs) deliver time-synchronized measurements that strengthen situational awareness in modern power grids. While analyzing PMU data can detect issues like voltage instability and power oscillations, conventional methods analyze PMU data only after it reaches a centralized data aggregator, introducing delays that impede real-time detection. To overcome this limitation, we integrate data plane programmability, specifically P4 (Programming Protocol-independent Packet Processors), into PMU networks, using P4's deep packet inspection and customizable parsing capabilities to detect power system events directly within the network. Our detection system features a two-layer design: a data plane for rapid packet inspection and a control plane for advanced analysis using machine learning models, such as Vector Autoregression (VAR) and Gradient Boosting Machine (GBM). Evaluation results show high detection accuracy and speed; for instance, using a dataset of 5,000 packets with 1% anomalies, our system achieved a false positive rate as low as 0.19% with a detection time of 5.02 ms, demonstrating its effectiveness for real-time event detection in PMU networks.

P4 serves as a programming language for configuring flexible and programmable network data planes, facilitating the development of custom protocols and programmable switches, and driving innovation in software-defined networking and network function virtualization. While the Linux container based network emulator, Mininet, coupled with the BMv2 software P4 switch, is widely used for rapid prototyping of P4-based applications, BMv2’s diminished performance raises fidelity concerns under high traffic and large network scenarios. In this paper, we introduce a lightweight virtual time system integrated into Mininet with BMv2 to enhance fidelity and scalability. By applying a time dilation factor (TDF) to interactions between containers and the physical machine, we optimize the emulated P4 network’s perceived speed from the application processes’ perspective. System evaluation demonstrates accurate emulation of significantly larger networks under high loads with minimal system overhead. We showcase our system’s utility through two network applications: an emulation of a TCP SYN flood attack and an ECMP load balancer. Evaluating against a production-grade software switch, Open vSwitch, and a physical testbed, we highlight the virtual time system’s improvement in temporal fidelity despite the observed performance degradation in BMv2 software switches.

Cyber-security for Industrial Control Systems (ICS) such as SCADA systems has been an important avenue of research over the last couple of decades. The need for secure ICS systems stems from several factors - legacy protocols, limited segmentation between operational technology (OT) and information technology (IT) networks, and increasing connectivity of ICS devices to corporate networks and the Internet, among others. Given the unique challenges to ICS security and the unique characteristics of ICS systems and network traffic, we propose a dynamic data-driven security framework utilizing P4 programmable switches. Our proposed framework consists of a switch-controller feedback loop mechanism that enables real-time cyber attack detection and mitigation. The P4 switch with its custom packet processing capabilities, generates statistics and metrics based on network traffic patterns. The controller employs these insights to further detect and mitigate attacks by updating forwarding rules on the switch in real time. Our prototype system of a Denial-of-Service defense on a Modbus network demonstrates the promising potential of P4-based DDDAS towards real-time cyber-defense for ICS networks.

Securing the smart grid demands bridging the gaps between power systems and cybersecurity. In this work, we present an enhanced virtual platform built on Academic Cloud to support smart grid security, resilience, and workforce development. The platform enables exploration and training with emerging networking technologies, specifically, P4 data plane programmability, prior to real-world deployment. We developed a new set of interactive training modules focused on P4-based security applications for smart grid protection. To support these modules, we built a customizable virtual environment that enhances accessibility and user engagement, and we redesigned the configuration interface to improve usability and support hardware switch integration. Finally, we present two case studies, missing PMU data recovery and DNP3 length overflow attack detection, that provide users with hands-on experience in developing P4 pipeline logic.

Phasor Measurement Units (PMUs) enable high-speed and high-precision power quality measurements, but their vulnerability to cyber-attacks poses substantial risks to the stability and reliability of power systems. This paper explores the application of programmable networks, specifically P4 switches, to enhance the cybersecurity of PMU systems. These switches can be programmed to enable the creation of custom forwarding and processing logic at the data plane level. We analyze PMU-specific attacks through attack trees, propose effective mitigation strategies using programmable switches, and present a case study demonstrating the recovery of missing synchrophasor data by implementing a matrix completion algorithm on the switch data plane. The recovery scheme is evaluated in a container-based P4 network emulator using real PMU data from a campus microgrid. For instance, in the 10% missing data scenario, the recovery scheme can achieve a mean absolute percentage error of 0.038% for voltage magnitude and a phase angle error discrepancy of around 0.08 degrees.

P4, an emerging technology enabling flexible and programmable data plane processing in network devices, has garnered significant attention for revolutionizing in-network operations. Validating P4 programs requires specially designed testing environments to emulate network functionality in hosts and programmable switches. However, the choice of testbed involves weighing various pros and cons. In this paper, we assess four commonly used testbeds, i.e., container-based network emulation on the virtual machine, native Linux, and native Linux with Virtual Time, as well as physical hardware, to provide comparisons and offer guidelines for developers in selecting the most suitable P4 testbed for their needs.

Quantum network simulators offer the opportunity to cost-efficiently investigate potential avenues for building networks that scale with the number of users, communication distance, and application demands by simulating alternative hardware designs and control protocols. Several quantum network simulators have been recently developed with these goals in mind. As the size of the simulated networks increases, however, sequential execution becomes time-consuming. Parallel execution presents a suitable method for scalable simulations of large-scale quantum networks, but the unique attributes of quantum information create unexpected challenges. In this work, we identify requirements for parallel simulation of quantum networks and develop the first parallel discrete-event quantum network simulator by modifying the existing serial simulator SeQUeNCe. Our contributions include the design and development of a quantum state manager (QSM) that maintains shared quantum information distributed across multiple processes. We also optimize our parallel code by minimizing the overhead of the QSM and decreasing the amount of synchronization needed among processes. Using these techniques, we observe a speedup of 2 to 25 times when simulating a 1,024-node linear network topology using 2 to 128 processes. We also observe an efficiency greater than 0.5 for up to 32 processes in a linear network topology of the same size and with the same workload. We repeat this evaluation with a randomized workload on a caveman network. We also introduce several methods for partitioning networks by mapping them to different parallel simulation processes. We have released the parallel SeQUeNCe simulator as an open source tool alongside the existing sequential version.

The escalating cyber-attacks targeting power infrastructure underscore the critical importance of smart grid security. However, existing solutions often struggle with the challenge of balancing security and performance overhead, leading to suboptimal protection or increased operational latency. To address this, we propose an intrusion detection system (IDS) designed to operate within P4-based programmable network devices, enabling real-time identification of critical attacks like distributed denial-of-service (DDoS) and false data injection (FDI). Central to our approach is a novel data structure optimized for time series data, capturing key information such as packet timing and data payload distribution. Leveraging decision trees, a robust machine learning technique, enables effective anomaly detection and prediction. Additionally, we integrate data compression techniques to reduce device memory usage while maintaining detection accuracy. Our evaluation results demonstrate minimal overhead in packet processing speed with 1 to 20 nanoseconds differences per packet, and enhanced data storage efficiency with compression ratios reaching up to 60.9%. Despite these optimizations, there is only a slight decrease in detection accuracy, such as a 2.81% drop in detecting false data injection attack (FDIA).

Network emulation allows unmodified code execution on lightweight containers to enable accurate and scalable networked application testing. However, such testbeds cannot guarantee fidelity under high workloads, width) that are more than the underlying physical machine can offer. A virtual time system enables the emulated hosts to maintain their own notion of virtual time. A container can stop advancing its time when not running (e.g., in an idle or suspended state). The existing virtual time systems focus on precise time management for CPU-intensive applications but are not designed to handle other operations, such as disk I/O, network I/O, and GPU computation. In this article, we develop a lightweight virtual time system that integrates precise I/O time for container-based network emulation. We model and analyze the temporal error during I/O operations and develop a barrier-based time compensation mechanism in the Linux kernel. We also design and implement Dynamic Load Monitor (DLM) to mitigate the temporal error during I/O resource contention. VT-IO enables accurate virtual time advancement with precise I/O time measurement and compensation. The experimental results demonstrate a significant improvement in temporal error with the introduction of DLM. The temporal error is reduced from 7.889 seconds to 0.074 seconds when utilizing the DLM in the virtual time system. Remarkably, this improvement is achieved with an overall overhead of only 1.36% of the total execution time.