UNsupervised Learning for DER (UNDER): Detecting Power System Attacks Using Machine Learning and Digital Twins

This proposal contains information that shall not be disclosed outside the Federal Government and shall not be duplicated, used, or disclosed in whole or in part for any purpose other than evaluation of this proposal, unless authorized by law. The Government shall have the right to duplicate, use, or disclose the data to the extent provided in the resulting contract if award is made as a result of the submission of this proposal. The information subject to these restrictions are contained on all pages of the proposal. Power systems and grid-edge devices face escalating cyber-physical threats that exploit both network weaknesses and device-level vulnerabilities. Conventional cybersecurity solutions focus on detecting anomalies within digital communications but overlook the physical behavior of power assets. Consequently, attackers can deploy zero-day exploits or slow-moving stealth attacks that appear benign at the network layer yet manifest as abnormal voltage, current, or operational states at the physical layer. Detecting such subtle manipulations is nearly impossible when relying on either cyber or physical data alone. Most cybersecurity solution providers do not analyze the physical behaviors of Distributed Energy Resource (DER) systems to detect cyberattacks. This evolved approach to cybersecurity has only been developed for distributed energy assets in the last few years at the national laboratories.1,2,3,4However, there are several options for extracting critical DER system information to provide protection against malicious operations and false data injection attacks. Direct, periodic communications with site sensors, power meters, and the DER or inverter-based resource (IBR) to get measurements, control settings, and/or logs provides the necessary data. Alternatively, information can be gathered using an Intrusion Detection System (IDS) on a local area network Switched Port Analyzer (SPAN) port or network tap. In that case, the IDS passively pulls physical data from the operational technology (OT) traffic between the DER/IBR devices and the Distributed Energy Resource Management System (DERMS) via SunSpec Modbus, Distributed Network Protocol 3 (DNP3), Institute of Electrical and Electronics Engineers (IEEE) 2030.5, OPC Unified Architecture (OPC UA), International Electrotechnical Commission (IEC) 61850 or other protocols. Asset owners or grid operators will also know expected system behavior based on programmed settings stored in DERMS databases. Until DER Security Corp (DERSec) introduced its IDS solution, none of the data identified above was collected or analyzed by IDS tools in operational DER systems. The benefit of this technology is that when local DER/IBR behaviors deviate from normal, they are flagged as suspicious using preprogrammed heuristic rules and model-based analytics and digital twins. There is a tremendous opportunity to enhance the cyber resilience of distributed grid infrastructure using energy-informed analytics. As shown in Figure 1, with appropriate R&D investment into a set of robust detection rules and algorithms, DER systems can be protected against a range of attacks originating locally, from the public internet, or from insider threats. These attacks cannot be defended using traditional networkbased IDSs because the traffic on the network appears to be valid. To determine network traffic invalidity, the IDS must inspect the physical settings data inside the network payload or evaluate the operation of the DER (a.k.a. Inverter Based Resource or “IBR”) after the payload is delivered. Traditional rule-based methods are insufficient against cunning adversaries who incrementally degrade system performance, knowing that each individual step may look benign. Instead, machine learning and model-based approaches can continuously learn the “expected” operational patterns for a device or system and detect deviations in real time. By integrating real-time physical signals (e.g., voltage, current, power flow) with network meta data (e.g., access logs, command histories, traffic patterns), utilities, operators, and asset owners gain a comprehensive view of system integrity. This combined cyberphysical analysis not only detects known threats more reliably but also identifies zero-day and stealthy exploits that evade signature-based intrusion detection. Ultimately, such a solution is essential for safeguarding the evolving power grid from increasingly sophisticated cyber-physical attacks. DER Security Corp will enhance the DERSec Security Platform IDS by integrating a Unified Machine Learning Framework (UMLF) that leverages unsupervised learning to detect cyber-physical threats in distributed energy resources. Unlike supervised methods, unsupervised learning is uniquely suited for DER environments due to the scarcity of labeled attack data and the dynamic, heterogeneous nature of grid-edge systems. Attackers constantly evolve tactics, rendering signature-based detection obsolete, while