Towards a Supervised Machine Learning Algorithm for Cyberattacks Detection and Prevention in a Smart Grid Cybersecurity System

Critical infrastructure cyberattacks have become a significant threat to national security worldwide. Adversaries exploit vulnerabilities in communication networks, technologies, and protocols of smart grid control systems network to gain access and control of power grids, causing blackouts. Despite the need to safeguard the reliable and stable operation of the grid against cyberattacks, simultaneously detecting and preventing attacks presents a significant challenge. To address this, a Kali Linux machine was connected to a smart grid control system network emulated in GNS3 to perform common cyberattacks. Wireshark was then deployed to capture network traffic for machine learning. Aiming to improve the detection and prevention of cyberattacks the study proposed a dual-tasked ensemble supervised machine learning model, a combination of Neural Network and Extreme Gradient Boosting, that had an average accuracy of 99.60% and detection rate of 99.48%. The first task of the model distinguishes between normal state and cyberattack modes of operation. The second task prevents suspicious packets from reaching the network destination devices. Leveraging the PowerShell Script, the model dynamically applies packet filtering firewall rules based on its predictions. The proposed model was tested on new data, producing an accuracy of 99.19% and a detection rate of 98.95%. Furthermore, the model’s performance was compared to existing proposed cyberattack detection models. Thus, the proposed model, with its function as a firewall, enhances the overall security capabilities of the smart grid and significantly mitigates potential cyberattacks.