Explainable Autonomic Cybersecurity System for Smart Power Grid

The proliferation of high-speed networks in modern power systems has increased the interaction between internet and physical infrastructures, making them vulnerable to cyber-attacks. In response to this challenge, this paper offers a comprehensive power system simulation process and introduces the notion of explainable autonomic cybersecurity (eACS) for smart power grids. This approach leverages the existing framework in the area of autonomic cybersecurity, but with a specific focus on model explainability. Our testbed emulates a smart grid, incorporating data from power system components, a control center, and a substation. We implement a 2-level self-aware autonomic system with micro-intrusion detection systems (IDS) monitoring the control system, substation, and physical aspects of the smart grid separately. These micro-IDS feed their findings into an aggregator that identifies the threat type and provides an active response to mitigate it. The active countermeasure component automatically generates dedicated firewall rules based on the model's explainer, accompanied by a detailed diagnostic report to aid security analysts. Our results demonstrate that this approach effectively detects and reports a wide range of attacks, aiding in their mitigation.