Machine Learning Detects and Prevents Grid Cyberattacks

The increasing digitization of industrial control systems (ICS) has undeniably boosted efficiency in critical infrastructure. Smart grids, water treatment facilities, and manufacturing plants now rely on networked Supervisory Control and Data Acquisition (SCADA) protocols, such as IEC 60870-5-104. But this connectivity carries risks. From false data injections to denial-of-service (DoS) and rogue device infiltrations, attackers exploit outdated or unprotected protocols to disrupt operations.

The stakes are high. ICS is the backbone of power grids and other critical systems, making its protection a matter of national security. Researchers have proposed a multi-pronged cybersecurity architecture that blends anomaly detection, cryptographic strength, and post-attack forensics. Their approach is tailored to ICS’s unique needs: low-latency, protocol-aware security capable of adapting to evolving and even zero-day threats.

Cybersecurity is crucial to reliable power grids. Image used courtesy of Adobe Stock

ML at the Edge

The study in Scientific Reports proposes an ML-driven intrusion detection pipeline. Using the IEC 60870-5-104 dataset, the team balanced rare attack data with synthetic samples via the SMOTE technique. Six models were benchmarked, with Random Forest classifiers delivering perfect scores across accuracy, precision, recall, and F1.

​​

Process flow of a Random Forest classifier. Image used courtesy of Dokku et al.

Unlike many ML studies that stop at software validation, the researchers tested real-world feasibility by deploying their Random Forest model on a Google Coral Dev Board. This edge implementation, running on low power with an integrated TPU, showed that smart grids could realistically use the framework for live anomaly detection.

Complementing the classifier, an Isolation Forest model provides unsupervised anomaly detection in streaming conditions. In simulated real-time traffic, it detected zero-day intrusions within milliseconds, flagging and isolating malicious IP activity before it could spread.

Process flow of an Isolation Forest classifier. Image used courtesy of Dokku et al.

Dynamic Key Rotation

Beyond detection, the system fortifies ICS communications with a novel cryptographic layer: AES-256-CBC encryption driven by BLAKE3-based dynamic key rotation. Keys are regenerated every 60 seconds from a UTC timestamp, hashed with BLAKE3, and discarded immediately after expiry through a process the authors call crypto-shredding.

This design means that the intercepted ciphertext becomes useless within a minute, drastically limiting an attacker’s window of opportunity. Security tests validated resilience against known-plaintext, chosen-plaintext, and ciphertext-only attacks, with complexity ratings beyond 2³⁸⁴. Shannon entropy and chi-square analyses confirmed high randomness, while ECB detection showed no repeating patterns. The combination of strong diffusion, minimal memory overhead, and GDPR-compliant data disposal makes this approach particularly suited to high-demand systems like smart grids.

Zero-day attack simulation. Image used courtesy of Dokku et al.

Even with protective defenses, however, breaches remain possible. The study integrates a Bayesian-driven forensic module to analyze attacks after they occur. The framework supports precise attribution and remediation by tracking exploited IP patterns, attacker behavior, and systemic weaknesses.

XGBoost Intrusion Detection

In addition to Random Forest and Isolation Forest, the researchers deployed an XGBoost model to classify IEC-104 traffic. The model achieved flawless detection with zero false positives or negatives, a rare feat in cybersecurity, where false alarms often overwhelm operators.

XGBoost can parse subtle, nonlinear attack signatures while avoiding overfitting, making it suitable for real-world smart grid applications. Together with the hardware-validated Random Forest and streaming Isolation Forest, it forms a layered detection ecosystem resilient to both known and unknown threats.

Ultimately, the framework’s emphasis on real-time adaptability, edge deployability, and forensic learning positions it as a model for resilient cybersecurity in power systems and beyond.