Cyber-physical metropolitan area digital substations test bench for evaluating intrusion detection systems

This paper introduces a cyber-physical test bench for metropolitan area digital substations, which serves as a platform for studying advanced cyber-attacks and evaluating intrusion detection systems. The test bench provides a hardware-in-the-loop environment with a high Technology Readiness Level (TRL). Additionally, the paper demonstrates the testbed's capabilities by testing and validating an AI-based intrusion detection system developed by an industrial company. The demonstration includes testing the cybersecurity tool against a wide range of cyber-attacks, such as false data injection, packet replay, and time desynchronization, on relevant substation automation protocols commonly used in EU power grid infrastructures like IEC-60870-5-104 and IEC61850. The results of the demonstration indicate that the test bench effectively simulates realistic impacts on substation operation when subjected to attacks, thus providing the opportunity to validate the anomaly detection solution.