{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,29]],"date-time":"2026-05-29T14:13:48Z","timestamp":1780064028773,"version":"3.54.0"},"reference-count":82,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T00:00:00Z","timestamp":1750118400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T00:00:00Z","timestamp":1750118400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100003246","name":"Nederlandse Organisatie voor Wetenschappelijk Onderzoek","doi-asserted-by":"publisher","award":["CS.016"],"award-info":[{"award-number":["CS.016"]}],"id":[{"id":"10.13039\/501100003246","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Energy Inform"],"abstract":"<jats:title>Abstract<\/jats:title>\n          <jats:p>The transition to sustainable energy increasingly relies on robust communication infrastructure to monitor, control, and optimize energy distribution. Supervisory Control and Data Acquisition (SCADA) networks manage these processes, transmitting sensor data and control commands. However, integrating (smart) communication systems into an ageing existing communication infrastructure introduces vulnerabilities to cyber-attacks, such as false data injection and man-in-the-middle attacks. Although recent advancements in Intrusion Detection Systems (IDS) for SCADA networks show potential in detecting domain-specific threats, testing has largely been confined to simulations due to the nature of critical infrastructure. This paper presents two real-world case studies using actual grid data, where a process-aware IDS solution is tailored to specific network topologies. The result effectively detects various cyber-attacks, including those targeting critical devices like transformers. This work marks a crucial step toward practical deployment, emphasizing the need for a gradual transition from simulation to real-world validation to ensure the safety and reliability of critical grid infrastructure.<\/jats:p>","DOI":"10.1186\/s42162-025-00545-1","type":"journal-article","created":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T09:58:31Z","timestamp":1750154311000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":4,"title":["Real-world case studies for a process-aware IDS"],"prefix":"10.1186","volume":"8","author":[{"given":"Verena","family":"Menzel","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Johann","family":"Hurink","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Anne","family":"Remke","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2025,6,17]]},"reference":[{"key":"545_CR1","doi-asserted-by":"publisher","unstructured":"Sommestad T, Ericsson GN, Nordlander J (2010). SCADA system cyber security. A comparison of standards. In: IEEE PES general meeting, pp 1\u20138. https:\/\/doi.org\/10.1109\/PES.2010.5590215","DOI":"10.1109\/PES.2010.5590215"},{"key":"545_CR2","doi-asserted-by":"publisher","DOI":"10.1007\/s40012-013-0013-5","author":"D Pidikiti","year":"2013","unstructured":"Pidikiti D, Kalluri R, Kumar R, Bindhumadhava B (2013) SCADA communication protocols: vulnerabilities, attacks and possible mitigations. CSI Trans ICT https:\/\/doi.org\/10.1007\/s40012-013-0013-5","journal-title":"CSI Trans ICT"},{"key":"545_CR3","doi-asserted-by":"publisher","DOI":"10.3390\/en15186799","author":"J Ding","year":"2022","unstructured":"Ding J, Qammar A, Zhang Z, Karim A, Ning H (2022) Cyber threats to smart grids: Review, taxonomy, potential solutions, and future directions. Energies https:\/\/doi.org\/10.3390\/en15186799","journal-title":"Energies"},{"key":"545_CR4","doi-asserted-by":"publisher","first-page":"135812","DOI":"10.1109\/ACCESS.2019.2926441","volume":"7","author":"S Ghosh","year":"2019","unstructured":"Ghosh S, Sampalli S (2019) A Survey of Security in SCADA Networks: Current Issues and Future Challenges. IEEE Access 7:135812\u2013135831. https:\/\/doi.org\/10.1109\/ACCESS.2019.2926441","journal-title":"IEEE Access"},{"key":"545_CR5","unstructured":"Chien E, Falliere N, Murchu L (2011) W32. Stuxnet dossier. Symantec. Feb 4"},{"issue":"5","key":"545_CR6","doi-asserted-by":"publisher","first-page":"28","DOI":"10.1109\/MAES.2017.160047","volume":"32","author":"L Fillatre","year":"2017","unstructured":"Fillatre L, Nikiforov I, Willett P et al (2017) Security of SCADA systems against cyber-physical attacks. IEEE Aerosp Electron Syst Mag 32(5):28\u201345","journal-title":"IEEE Aerosp Electron Syst Mag"},{"key":"545_CR7","doi-asserted-by":"publisher","first-page":"1375","DOI":"10.1109\/ACCESS.2016.2549047","volume":"4","author":"A Sajid","year":"2016","unstructured":"Sajid A, Abbas H, Saleem K (2016) Cloud-Assisted IoT-Based SCADA Systems Security: A Review of the State of the Art and Future Challenges. IEEE Access 4:1375\u20131384. https:\/\/doi.org\/10.1109\/ACCESS.2016.2549047","journal-title":"IEEE Access"},{"key":"545_CR8","unstructured":"Assante M. Confirmation of a Coordinated Attack on the Ukrainian Power Grid. https:\/\/www.sans.org\/blog\/confirmation-of-a-coordinated-attack-on-the-ukrainian-power-grid (2016 (Last accessed on 2025\/06\/08 06:53:05))"},{"key":"545_CR9","doi-asserted-by":"publisher","unstructured":"Yadav SA, Kumar SR, Sharma S, Singh A (2016) A review of possibilities and solutions of cyber attacks in smart grids. In: 2016 International Conference on Innovation and Challenges in Cyber Security (ICICCS-INBUSH), pp. 60\u201363. https:\/\/doi.org\/10.1109\/ICICCS.2016.7542359","DOI":"10.1109\/ICICCS.2016.7542359"},{"issue":"3","key":"545_CR10","doi-asserted-by":"publisher","first-page":"1942","DOI":"10.1109\/COMST.2020.2987688","volume":"22","author":"D Pliatsios","year":"2020","unstructured":"Pliatsios D, Sarigiannidis P, Lagkas T, Sarigiannidis AG (2020) A Survey on SCADA Systems: Secure Protocols, Incidents, Threats and Tactics. IEEE Communications Surveys & Tutorials 22(3):1942\u20131976. https:\/\/doi.org\/10.1109\/COMST.2020.2987688","journal-title":"IEEE Communications Surveys & Tutorials"},{"issue":"1","key":"545_CR11","doi-asserted-by":"publisher","first-page":"417","DOI":"10.1109\/TSTE.2018.2800108","volume":"10","author":"M Bell","year":"2019","unstructured":"Bell M, Berkel F, Liu S (2019) Real-Time Distributed Control of Low Voltage Grids with Dynamic Optimal Power Dispatch of Renewable Energy Sources. IEEE Transactions on Sustainable Energy 10(1):417\u2013125","journal-title":"IEEE Transactions on Sustainable Energy"},{"key":"545_CR12","doi-asserted-by":"publisher","unstructured":"Valdes A, Cheung S (2009) Communication pattern anomaly detection in process control systems. In: 2009 IEEE conference on technologies for homeland security, pp 22\u201329. https:\/\/doi.org\/10.1109\/THS.2009.5168010","DOI":"10.1109\/THS.2009.5168010"},{"key":"545_CR13","doi-asserted-by":"publisher","unstructured":"Brand M, Ansari S, Castro F, Chakra R, Hassan BH, Kr\u00fcger C, Babazadeh D, Lehnhof S (2019) A Framework for the Integration of ICT-relevant Data in Power System Applications. In: 2019 IEEE Milan PowerTech, pp. 1\u20136. https:\/\/doi.org\/10.1109\/PTC.2019.8810654","DOI":"10.1109\/PTC.2019.8810654"},{"key":"545_CR14","unstructured":"International Electrotechnical Commission (IEC): IEC 62443 - Industrial Communication Networks\u2013 Network and System Security. Technical report, International Electrotechnical Commission (IEC) (2019). https:\/\/webstore.iec.ch\/en\/publication\/7029"},{"key":"545_CR15","unstructured":"North American Electric Reliability Corporation (NERC): Critical Infrastructure Protection (CIP) Standards (2025). https:\/\/www.nerc.com\/pa\/Stand\/Pages\/ReliabilityStandards.aspx"},{"key":"545_CR16","unstructured":"National Institute of Standards and Technology (2024) Cybersecurity Framework Version 2.0. https:\/\/www.nist.gov\/cyberframework. Accessed 20 May 2025"},{"key":"#cr-split#-545_CR17.1","unstructured":"Stouffer K, Falco J, Newhouse W, Scarfone K, Booth H (2023) Guide to Operational technology"},{"key":"#cr-split#-545_CR17.2","unstructured":"(OT) security: NIST Special Publication 800-82 Revision 3. Technical Report NIST SP 800-82r3, National Institute of Standards and Technology. Accessed 20 May 2025"},{"key":"545_CR18","unstructured":"Directive (EU) 2022\/2555 of the European Parliament and of the Council of 14 Dec 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910\/2014 and Directive (EU) 2018\/1972, and repealing Directive (EU) 2016\/1148 (NIS 2 Directive). Accessed 20 May 2025 (2022). https:\/\/eur-lex.europa.eu\/eli\/dir\/2022\/2555\/oj"},{"key":"545_CR19","doi-asserted-by":"publisher","unstructured":"Chromik J, Remke A, Haverkort B (2016) Improving SCADA security of a local process with a power grid model. In: Proceedings of the 4th international symposium for ICS & SCADA cyber security research, pp 114\u2013123. https:\/\/doi.org\/10.14236\/ewic\/ICS2016.13","DOI":"10.14236\/ewic\/ICS2016.13"},{"key":"545_CR20","doi-asserted-by":"publisher","unstructured":"Chromik JJ, Pilch C, Brackmann P, Duhme C, Everinghoff F, Giberlein A, Teodorowicz T, Wieland J, Haverkort BR, Remke A (2017) Context-aware local intrusion detection in SCADA systems: a testbed and two showcases. In: 2017 IEEE international conference on smart grid communications (SmartGridComm), pp 467\u2013472. https:\/\/doi.org\/10.1109\/SmartGridComm.2017.8340672","DOI":"10.1109\/SmartGridComm.2017.8340672"},{"key":"545_CR21","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s42162-018-0058-7","volume":"1","author":"J Chromik","year":"2018","unstructured":"Chromik J, Remke A, Haverkort B (2018) An integrated testbed for locally monitoring SCADA systems in smart grids. Energy Informatics 1:1\u201329. https:\/\/doi.org\/10.1186\/s42162-018-0058-7","journal-title":"Energy Informatics"},{"key":"545_CR22","doi-asserted-by":"publisher","unstructured":"Chromik J (2019) Process-aware SCADA traffic monitoring: a local approach. PhD thesis, University of Twente, Netherlands. https:\/\/doi.org\/10.3990\/1.9789036548014","DOI":"10.3990\/1.9789036548014"},{"key":"545_CR23","doi-asserted-by":"publisher","unstructured":"Flosbach R, Chromik J, Remke A (2019) Architecture and Prototype Implementation for Process-Aware Intrusion Detection in Electrical Grids. In: 38th Symp. on Reliable Distributed Systems (SRDS), pp. 42\u201351. https:\/\/doi.org\/10.1109\/SRDS47363.2019.00015","DOI":"10.1109\/SRDS47363.2019.00015"},{"key":"545_CR24","doi-asserted-by":"publisher","unstructured":"Menzel V, Hurink JL, Remke A (2021) Securing SCADA networks for smart grids via a distributed evaluation of local sensor data. In: 2021 IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SmartGridComm), pp. 405\u2013411. https:\/\/doi.org\/10.1109\/SmartGridComm51999.2021.9632283","DOI":"10.1109\/SmartGridComm51999.2021.9632283"},{"key":"545_CR25","doi-asserted-by":"publisher","unstructured":"Menzel V, Arias NB, Hurink JL, Remke A (2023) Securing smart grids locally using a power flow-based intrusion detection system. In: 2023 IEEE Belgrade PowerTech, pp. 1\u20139. https:\/\/doi.org\/10.1109\/PowerTech55446.2023.10202762","DOI":"10.1109\/PowerTech55446.2023.10202762"},{"key":"545_CR26","doi-asserted-by":"publisher","unstructured":"Menzel V, Gro\u00dfhanten KO, Remke A (2023) Evaluating a process-aware ids for smart grids on distributed hardware. In: 2023 IEEE International Conference on Cyber Security and Resilience (CSR), pp. 418\u2013425. https:\/\/doi.org\/10.1109\/CSR57506.2023.10224985","DOI":"10.1109\/CSR57506.2023.10224985"},{"key":"545_CR27","doi-asserted-by":"publisher","unstructured":"Menzel V, Speckamp J, Remke A (2024) Developing a Robust Communication Infrastructure for a Distributed Smart Grid IDS. In: 2024 IEEE International Conference on Cyber Security and Resilience (CSR), pp. 01\u201308. https:\/\/doi.org\/10.1109\/CSR61664.2024.10679379","DOI":"10.1109\/CSR61664.2024.10679379"},{"key":"545_CR28","doi-asserted-by":"publisher","unstructured":"Hoogsteen G, Hurink JL, Smit GJM (2019) DEMKit: a Decentralized Energy Management Simulation and Demonstration Toolkit. In: 2019 IEEE PES Innovative Smart Grid Technologies Europe (ISGT-Europe), pp. 1\u20135. https:\/\/doi.org\/10.1109\/ISGTEurope.2019.8905439","DOI":"10.1109\/ISGTEurope.2019.8905439"},{"key":"545_CR29","doi-asserted-by":"publisher","unstructured":"Hoogsteen G (2017) A Cyber-Physical Systems Perspective on Decentralized Energy Management. PhD thesis, University of Twente, Netherlands. https:\/\/doi.org\/10.3990\/1.9789036544320","DOI":"10.3990\/1.9789036544320"},{"key":"545_CR30","doi-asserted-by":"publisher","DOI":"10.3390\/app9050923","author":"C Steinbrink","year":"2019","unstructured":"Steinbrink C, Blank-Babazadeh M, El-Ama A, Holly S, L\u00fcers B, Nebel-Wenner M, Ram\u00edrez\u00a0Acosta RP, Raub T, Schwarz JS, Stark S, Nie\u00dfe A, Lehnhoff S (2019) CPES testing with mosaik: co-simulation planning, execution and analysis. Appl Sci https:\/\/doi.org\/10.3390\/app9050923","journal-title":"Appl Sci"},{"key":"545_CR31","doi-asserted-by":"publisher","unstructured":"Menzel V, Dirksen P, Remke A (2025) Interfacing Process-Aware Intrusion Detection for Distributed Energy Sources with DEMKit. In: Proceedings of the 16th ACM international conference on future and sustainable energy systems (E-ENERGY \u201925), p 2. ACM, Rotterdam, Netherlands. https:\/\/doi.org\/10.1145\/3679240.3734676","DOI":"10.1145\/3679240.3734676"},{"key":"545_CR32","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.103028","volume":"125","author":"M Alanazi","year":"2023","unstructured":"Alanazi M, Mahmood A, Chowdhury MJM (2023) Scada vulnerabilities and attacks: A review of the state-of-the-art and open issues. Computers & Security 125:103028. https:\/\/doi.org\/10.1016\/j.cose.2022.103028","journal-title":"Computers & Security"},{"key":"545_CR33","doi-asserted-by":"publisher","unstructured":"Menzel V (2022) Isolate: Integrated distributed scada security through local approximations of power flow equations. In: Abstracts of the 11th DACH+ Conference on Energy Informatics. Energy Informatics, p. 52. Springer, Freiburg, Germany. https:\/\/doi.org\/10.1186\/s42162-022-00215-6. Albert-Ludwigs-Universit\u00e4t Freiburg","DOI":"10.1186\/s42162-022-00215-6"},{"key":"545_CR34","unstructured":"Joshi V, Adhikari MS, Patel R, Singh R, Gehlot A (2019) Industrial Automation: Learn the Current and Leading-Edge Research on SCADA Security, 1st edn. BPB Publications, New Delhi, India. Available at https:\/\/books.google.de\/books?id=QV6wDwAAQBAJ"},{"key":"545_CR35","doi-asserted-by":"crossref","unstructured":"Xu Y, Yang Y, Li T, Ju J, Wang Q (2017) Review on cyber vulnerabilities of communication protocols in industrial control systems. In: 2017 IEEE conference on energy internet and energy system integration (EI2), 1\u20136","DOI":"10.1109\/EI2.2017.8245509"},{"key":"545_CR36","unstructured":"Matou\u0161ek P (2017) Description and analysis of iec 104 protocol. Technical report. https:\/\/www.fit.vut.cz\/research\/publication\/11570"},{"key":"545_CR37","doi-asserted-by":"publisher","unstructured":"Maynard P, McLaughlin K, Haberler B (2014) Towards understanding man-in-the-middle attacks on iec 60870-5-104 scada networks. In: Proceedings of the 2nd International Symposium on ICS & SCADA Cyber Security Research 2014. ICS-CSR 2014, pp. 30\u201342. BCS, Swindon, GBR. https:\/\/doi.org\/10.14236\/ewic\/ics-csr2014.5","DOI":"10.14236\/ewic\/ics-csr2014.5"},{"key":"545_CR38","unstructured":"Leitner S-H, Mahnke W (2006) OPC UA-Service-oriented architecture for industrial applications. Softwaretechnik-Trends 26"},{"key":"545_CR39","doi-asserted-by":"publisher","unstructured":"Erba A, M\u00fcller A, Tippenhauer NO (2021) Security analysis of vendor implementations of the OPC UA protocol for industrial control systems. arXiv: https:\/\/doi.org\/10.48550\/ARXIV.2104.06051. arXiv:2104.06051","DOI":"10.48550\/ARXIV.2104.06051"},{"issue":"1","key":"545_CR40","doi-asserted-by":"publisher","first-page":"9","DOI":"10.1186\/s42400-022-00114-z","volume":"5","author":"R Pinto","year":"2022","unstructured":"Pinto R, Gon\u00e7alves G, Delsing J et al (2022) Enabling data-driven anomaly detection by design in cyber-physical production systems. Cybersecurity 5(1):9 https:\/\/doi.org\/10.1186\/s42400-022-00114-z","journal-title":"Cybersecurity"},{"issue":"4","key":"545_CR41","doi-asserted-by":"publisher","first-page":"62","DOI":"10.1109\/MITP.2024.3396356","volume":"26","author":"A Armellin","year":"2024","unstructured":"Armellin A, Caviglia R, Gaggero G, Marchese M (2024) A framework for the deployment of cybersecurity monitoring tools in the industrial environment. IT Professional 26(4)62\u201370. https:\/\/doi.org\/10.1109\/MITP.2024.3396356","journal-title":"IT Professional"},{"key":"545_CR42","doi-asserted-by":"publisher","unstructured":"Koutsandria G, Muthukumar V, Parvania M, Peisert S, McParland C, Scaglione A (2014) A hybrid network ids for protective digital relays in the power transmission grid. In: 2014 IEEE International conference on smart grid communications (SmartGridComm), pp 908\u2013913. https:\/\/doi.org\/10.1109\/SmartGridComm.2014.7007764","DOI":"10.1109\/SmartGridComm.2014.7007764"},{"key":"545_CR43","unstructured":"Cheung S, Dutertre B, Fong M, Lindqvist U, Skinner K, Valdes A (2007) Using Model-based Intrusion Detection for SCADA Networks. In: SCADA security scientific symposium, pp 1\u201312"},{"issue":"4","key":"545_CR44","doi-asserted-by":"publisher","first-page":"2376","DOI":"10.1109\/TPWRD.2010.2050076","volume":"25","author":"UK Premaratne","year":"2010","unstructured":"Premaratne UK, Samarabandu J, Sidhu TS, Beresh R, Tan J (2010) An Intrusion Detection System for IEC61850 Automated Substations. IEEE Trans Power Delivery 25(4):2376\u20132383. https:\/\/doi.org\/10.1109\/TPWRD.2010.2050076","journal-title":"IEEE Trans Power Delivery"},{"key":"545_CR45","doi-asserted-by":"publisher","unstructured":"Lin H, Slagell A, Di\u00a0Martino C, Kalbarczyk Z, Iyer RK (2013) Adapting bro into scada: building a specification-based intrusion detection system for the dnp3 protocol. In: Proceedings of the eighth annual cyber security and information intelligence research workshop. CSIIRW \u201913. association for computing machinery, New York, NY, USA. https:\/\/doi.org\/10.1145\/2459976.2459982","DOI":"10.1145\/2459976.2459982"},{"key":"545_CR46","doi-asserted-by":"publisher","unstructured":"Ndonda GK, Sadre R (2018) A two-level intrusion detection system for industrial control system networks using p4. In: Proceedings of the 5th International Symposium for ICS & SCADA Cyber Security Research 2018 (ICS-CSR 2018), University of Hamburg, Germany, pp. 31\u201340. https:\/\/doi.org\/10.14236\/ewic\/ICS2018.4","DOI":"10.14236\/ewic\/ICS2018.4"},{"key":"545_CR47","doi-asserted-by":"publisher","unstructured":"Caselli M, Zambon E, Kargl F (2015) Sequence-aware intrusion detection in industrial control systems. In: Proceedings of the 1st ACM workshop on cyber-physical system security, pp 13\u201324. Association for computing machinery, New York. https:\/\/doi.org\/10.1145\/2732198.2732200","DOI":"10.1145\/2732198.2732200"},{"issue":"10","key":"545_CR48","doi-asserted-by":"publisher","first-page":"1345","DOI":"10.1109\/TSMC.2015.2415763","volume":"45","author":"C Zhou","year":"2015","unstructured":"Zhou C, Huang S, Xiong N, Yang S, Li H, Qin Y, Li X (2015) Design and Analysis of Multimodel-Based Anomaly Intrusion Detection Systems in Industrial Process Automation. IEEE Transactions on Systems, Man, and Cybernetics: Systems 45(10):1345\u20131360. https:\/\/doi.org\/10.1109\/TSMC.2015.2415763","journal-title":"IEEE Transactions on Systems, Man, and Cybernetics: Systems"},{"key":"545_CR49","doi-asserted-by":"publisher","unstructured":"Ullah I, Mahmoud QH (2017) A hybrid model for anomaly-based intrusion detection in scada networks. In: 2017 IEEE International Conference on Big Data (Big Data), pp. 2160\u20132167. https:\/\/doi.org\/10.1109\/BigData.2017.8258164","DOI":"10.1109\/BigData.2017.8258164"},{"key":"545_CR50","doi-asserted-by":"publisher","first-page":"49","DOI":"10.1007\/978-3-319-26567-4_4","volume-title":"Critical Infrastructure Protection IX","author":"M Caselli","year":"2015","unstructured":"Caselli M, Zambon E, Petit J, Kargl F (2015) Modeling message sequences for intrusion detection in industrial control systems. In: Rice M, Shenoi S (eds) Critical Infrastructure Protection IX. Springer, Cham, pp 49\u201371"},{"key":"545_CR51","doi-asserted-by":"publisher","first-page":"41874","DOI":"10.1109\/ACCESS.2022.3167814","volume":"10","author":"J-R Jiang","year":"2022","unstructured":"Jiang J-R, Chen Y-T (2022) Industrial control system anomaly detection and classification based on network traffic. IEEE Access 10:41874\u201341888. https:\/\/doi.org\/10.1109\/ACCESS.2022.3167814","journal-title":"IEEE Access"},{"key":"545_CR52","unstructured":"Sanders, e.a. Chris: Applied Network Security Monitoring: Collection, Detection, and Analysis. Elsevier Science & Technology Books, Rockland, MA (2014)"},{"key":"545_CR53","doi-asserted-by":"crossref","unstructured":"Costa LF, Giraldo JS, Castro CA (2022) Identification and correction of transmission line parameter errors using SCADA and synchrophasor measurements. Int. Journal of Electrical Power & Energy Systems 135(107509)","DOI":"10.1016\/j.ijepes.2021.107509"},{"issue":"6","key":"545_CR54","doi-asserted-by":"publisher","first-page":"3104","DOI":"10.1109\/TSG.2015.2409775","volume":"6","author":"S Pan","year":"2015","unstructured":"Pan S, Morris T, Adhikari U (2015) Developing a hybrid intrusion detection system using data mining for power systems. IEEE Transactions on Smart Grid 6(6):3104\u20133113. https:\/\/doi.org\/10.1109\/TSG.2015.2409775","journal-title":"IEEE Transactions on Smart Grid"},{"key":"545_CR55","doi-asserted-by":"publisher","unstructured":"Borges\u00a0Hink RC, Beaver JM, Buckner MA, Morris T, Adhikari U, Pan S (2014) Machine learning for power system disturbance and cyber-attack discrimination. In: 2014 7th International Symposium on Resilient Control Systems (ISRCS), pp. 1\u20138. https:\/\/doi.org\/10.1109\/ISRCS.2014.6900095","DOI":"10.1109\/ISRCS.2014.6900095"},{"key":"545_CR56","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijcip.2022.100508","volume":"37","author":"SH Majidi","year":"2022","unstructured":"Majidi SH, Hadayeghparast S, Karimipour H (2022) FDI Attack Detection Using Extra Trees Algorithm and Deep Learning Algorithm-Autoencoder in Smart Grid. Int J Crit Infrastruct Prot 37:100508. https:\/\/doi.org\/10.1016\/j.ijcip.2022.100508","journal-title":"Int J Crit Infrastruct Prot"},{"key":"545_CR57","unstructured":"Team C-E (2022) Security Guidance 22-001 - Cybersecurity mitigation measures against critical threats. ENISA and CERT-EU"},{"key":"545_CR58","doi-asserted-by":"publisher","first-page":"45","DOI":"10.1016\/j.ijepes.2017.12.020","volume":"99","author":"C-C Sun","year":"2018","unstructured":"Sun C-C, Hahn A, Liu C-C (2018) Cyber security of a power grid: State-of-the-art. International Journal of Electrical Power & Energy Systems 99:45\u201356. https:\/\/doi.org\/10.1016\/j.ijepes.2017.12.020","journal-title":"International Journal of Electrical Power & Energy Systems"},{"key":"545_CR59","doi-asserted-by":"crossref","unstructured":"Krause T, Ernst R, Klaer B, Hacker I, Henze M (2021) Cybersecurity in power grids: Challenges and opportunities. Sensors (Basel) 21(18)","DOI":"10.3390\/s21186225"},{"key":"545_CR60","doi-asserted-by":"publisher","unstructured":"Misyris GS, Venzke A, Chatzivasileiadis S (2020) Physics-informed neural networks for power systems. In: 2020 IEEE Power & Energy Society General Meeting (PESGM), pp. 1\u20135. https:\/\/doi.org\/10.1109\/PESGM41954.2020.9282004","DOI":"10.1109\/PESGM41954.2020.9282004"},{"key":"545_CR61","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.101994","volume":"97","author":"M Ashrafuzzaman","year":"2020","unstructured":"Ashrafuzzaman M, Das S, Chakhchoukh Y, Shiva S, Sheldon FT (2020) Detecting stealthy false data injection attacks in the smart grid using ensemble-based machine learning. Computers & Security 97:101994. https:\/\/doi.org\/10.1016\/j.cose.2020.101994","journal-title":"Computers & Security"},{"key":"545_CR62","doi-asserted-by":"publisher","first-page":"23597","DOI":"10.1109\/ACCESS.2025.3537410","volume":"13","author":"GB Gaggero","year":"2025","unstructured":"Gaggero GB, Girdinio P, Marchese M (2025) Artificial intelligence and physics-based anomaly detection in the smart grid: A survey. IEEE Access 13:23597\u201323606. https:\/\/doi.org\/10.1109\/ACCESS.2025.3537410","journal-title":"IEEE Access"},{"issue":"5","key":"545_CR63","doi-asserted-by":"publisher","first-page":"33","DOI":"10.1109\/MSP.2012.2187037","volume":"29","author":"Y-F Huang","year":"2012","unstructured":"Huang Y-F, Werner S, Huang J, Kashyap N, Gupta V (2012) State Estimation in Electric Power Grids: Meeting New Challenges Presented by the Requirements of the Future Grid. IEEE Signal Process Mag 29(5):33\u201343. https:\/\/doi.org\/10.1109\/MSP.2012.2187037","journal-title":"IEEE Signal Process Mag"},{"issue":"2","key":"545_CR64","doi-asserted-by":"publisher","first-page":"262","DOI":"10.1109\/5.824004","volume":"88","author":"A Monticelli","year":"2000","unstructured":"Monticelli A (2000) Electric power system state estimation. Proc IEEE 88(2):262\u2013282. https:\/\/doi.org\/10.1109\/5.824004","journal-title":"Proc IEEE"},{"key":"545_CR65","doi-asserted-by":"publisher","unstructured":"Al-Eryani Y, Baroudi U (2019) An Investigation on Detecting Bad Data Injection Attack in Smart Grid. In: 2019 International Conference on Computer and Information Sciences (ICCIS), pp. 1\u20134. https:\/\/doi.org\/10.1109\/ICCISci.2019.8716414","DOI":"10.1109\/ICCISci.2019.8716414"},{"key":"545_CR66","doi-asserted-by":"publisher","unstructured":"Gu Y, Liu T, Wang D, Guan X, Xu Z (2013) Bad data detection method for smart grids based on distributed state estimation. In: 2013 IEEE International Conference on Communications (ICC), pp. 4483\u20134487. https:\/\/doi.org\/10.1109\/ICC.2013.6655273","DOI":"10.1109\/ICC.2013.6655273"},{"issue":"2","key":"545_CR67","doi-asserted-by":"publisher","first-page":"1513","DOI":"10.1109\/TPWRS.2018.2871345","volume":"34","author":"L Che","year":"2019","unstructured":"Che L, Liu X, Li Z, Wen Y (2019) False Data Injection Attacks Induced Sequential Outages in Power Systems. IEEE Trans Power Syst 34(2):1513\u20131523. https:\/\/doi.org\/10.1109\/TPWRS.2018.2871345","journal-title":"IEEE Trans Power Syst"},{"issue":"2","key":"545_CR68","doi-asserted-by":"publisher","first-page":"206","DOI":"10.1109\/MCOM.2015.7045410","volume":"53","author":"P-Y Chen","year":"2015","unstructured":"Chen P-Y, Yang S, McCann JA, Lin J, Yang X (2015) Detection of false data injection attacks in smart-grid systems. IEEE Commun Mag 53(2):206\u2013213. https:\/\/doi.org\/10.1109\/MCOM.2015.7045410","journal-title":"IEEE Commun Mag"},{"key":"545_CR69","unstructured":"Bobba R, Davis K, Wang Q, Khurana H, Nahrstedt K, Overbye T (2010) Detecting false data injection attacks on dc state estimation"},{"issue":"3","key":"545_CR70","doi-asserted-by":"publisher","first-page":"2218","DOI":"10.1109\/TSG.2019.2949998","volume":"11","author":"AS Musleh","year":"2020","unstructured":"Musleh AS, Chen G, Dong ZY (2020) A survey on the detection algorithms for false data injection attacks in smart grids. IEEE Transactions on Smart Grid 11(3):2218\u20132234. https:\/\/doi.org\/10.1109\/TSG.2019.2949998","journal-title":"IEEE Transactions on Smart Grid"},{"key":"545_CR71","doi-asserted-by":"publisher","unstructured":"Liu Y, Ning P, Reiter MK (2011) False data injection attacks against state estimation in electric power grids. ACM Trans. Inf. Syst. Secur. 14(1) https:\/\/doi.org\/10.1145\/1952982.1952995","DOI":"10.1145\/1952982.1952995"},{"issue":"9","key":"545_CR72","doi-asserted-by":"publisher","first-page":"4529","DOI":"10.1109\/TAC.2022.3161259","volume":"67","author":"A-Y Lu","year":"2022","unstructured":"Lu A-Y, Yang G-H (2022) False data injection attacks against state estimation without knowledge of estimators. IEEE Trans Autom Control 67(9):4529\u20134540. https:\/\/doi.org\/10.1109\/TAC.2022.3161259","journal-title":"IEEE Trans Autom Control"},{"key":"545_CR73","doi-asserted-by":"publisher","unstructured":"Mo Y, Garone E, Casavola A, Sinopoli B (2010) False data injection attacks against state estimation in wireless sensor networks. In: 49th IEEE Conference on Decision and Control (CDC), pp. 5967\u20135972. https:\/\/doi.org\/10.1109\/CDC.2010.5718158","DOI":"10.1109\/CDC.2010.5718158"},{"key":"545_CR74","doi-asserted-by":"publisher","unstructured":"Shees A, Tariq M, Sarwat AI (2024) Cybersecurity in smart grids: Detecting false data injection attacks utilizing supervised machine learning techniques. Energies 17(23) https:\/\/doi.org\/10.3390\/en17235870","DOI":"10.3390\/en17235870"},{"key":"545_CR75","doi-asserted-by":"publisher","unstructured":"Sen O, Velde D, Linnartz P, Hacker I, Henze M, Andres M, Ulbig A (2021) Investigating man-in-the-middle-based false data injection in a smart grid laboratory environment. In: 2021 IEEE PES Innovative Smart Grid Technologies Europe (ISGT Europe), pp. 01\u201306. https:\/\/doi.org\/10.1109\/ISGTEurope52324.2021.9640002","DOI":"10.1109\/ISGTEurope52324.2021.9640002"},{"key":"545_CR76","unstructured":"NL Times: Employee Error Caused Power Outage at Schiphol and N. Netherlands. NL Times. https:\/\/nltimes.nl\/2015\/06\/12\/employee-error-caused-power-outage-schiphol-n-netherlands Accessed 2025-05-20"},{"issue":"5","key":"545_CR77","doi-asserted-by":"publisher","first-page":"3776","DOI":"10.1109\/TSG.2023.3244601","volume":"14","author":"AR Vadavathi","year":"2023","unstructured":"Vadavathi AR, Hoogsteen G, Hurink J (2023) PV Inverter-Based Fair Power Quality Control. IEEE Transactions on Smart Grid 14(5):3776\u20133790. https:\/\/doi.org\/10.1109\/TSG.2023.3244601","journal-title":"IEEE Transactions on Smart Grid"},{"key":"545_CR78","unstructured":"Hurink JL, Hoogsteen G, Vadavathi A, Bijwaard D, Mansour O, Nguyen P, Hussain JA, Smit GJM, Naafs H, i..S (August 2024) Openbaar Eindrapport Urban Energy - FairPlay: Fair Open Realtime Distributed Power Quality Control for Low Voltage Grids. Technical report. Projectnummer: TEUE419004. https:\/\/smartstatetechnology.nl\/wp-content\/uploads\/2024\/09\/Eindrapport_UrbanEnergy_FairPlay_openbaar-2024-08-21.pdf"},{"key":"545_CR79","doi-asserted-by":"crossref","unstructured":"Tran M-Q, Nguyen PH, Mansour O, Bijwaard D (2020) Utilizing measurement data from low-voltage grid sensor in state estimation to improve grid monitoring. In: 2020 55th International Universities Power Engineering Conference (UPEC), pp. 1\u20135","DOI":"10.1109\/UPEC49904.2020.9209790"},{"issue":"239","key":"545_CR80","first-page":"2","volume":"2014","author":"D Merkel","year":"2014","unstructured":"Merkel D (2014) Docker: lightweight linux containers for consistent development and deployment. Linux journal 2014(239):2","journal-title":"Linux journal"},{"key":"545_CR81","doi-asserted-by":"publisher","unstructured":"Ting KM (2010) In: Sammut, C., Webb, G.I. (eds.) Sensitivity and Specificity, pp. 901\u2013902. Springer, Boston, MA. https:\/\/doi.org\/10.1007\/978-0-387-30164-8_752","DOI":"10.1007\/978-0-387-30164-8_752"}],"container-title":["Energy Informatics"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42162-025-00545-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s42162-025-00545-1\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42162-025-00545-1.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T22:01:42Z","timestamp":1750197702000},"score":1,"resource":{"primary":{"URL":"https:\/\/energyinformatics.springeropen.com\/articles\/10.1186\/s42162-025-00545-1"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,6,17]]},"references-count":82,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2025,12]]}},"alternative-id":["545"],"URL":"https:\/\/doi.org\/10.1186\/s42162-025-00545-1","relation":{},"ISSN":["2520-8942"],"issn-type":[{"value":"2520-8942","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,6,17]]},"assertion":[{"value":"22 April 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"5 June 2025","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"17 June 2025","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"not applicable.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent to participate\u00a0"}},{"value":"The authors declare that they have no competing interests.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"86"}}