Work

Risk Indices Assessment of Different Cyber-Attack Actions for an SDN-Enabled IEC 61850 Substation Using Markov Decision Process

Year: 2025

Type: article

Abstract: IEC61850-based digital substations are widely used for electricity network power flow to be controlled and directed safely and securely from generation to demand. As digital substations are becoming software intensive and digitally connected to the grid cyberspace, they are vulnerable to cyberattacks. Thus, Software Defined Networking (SDN) technology can be used to enhance the security of digital substations. This paper aims to evaluate the security posture of SDN-enabled substations and to calculate the cyber risk indices of a substation under different attacks. The proposed approach uses (a) the Purdue Model to model attack scenarios using cyber-physical devices at different layers based on typical protection control device arrangement in a substation and (ii) the Markov Decision Process (MDP) model to assess cybersecurity risk indices for the substation. The assessment evaluates all possible attack patterns by an attacker to determine the severity of each attack path within the substation. The paper further compares the cybersecurity risk indices of the SDN-enabled substation with traditional switch-based substations. Results show that implementing SDN technology can significantly enhance substation security with improvements ranging from 6.9% to 100% and an average security enhancement of 68%.

Source: IEEE Access

DOI: 10.1109/access.2025.3583120

Authors: Zhihao Wu, Sugandh Seth, Haiyu Li, Zhirun Hu, James Yu

Institution: University of Manchester

Language: English

Topic: Smart Grid Security and Resilience

Subfield: Control and Systems Engineering

Field: Engineering

Domain: Physical Sciences

SDG: Industry, innovation and infrastructure

Open Access status: gold

Estimated APC paid: $2,075