{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,2]],"date-time":"2026-06-02T23:16:05Z","timestamp":1780442165940,"version":"3.54.1"},"reference-count":24,"publisher":"MDPI AG","issue":"8","license":[{"start":{"date-parts":[[2018,7,31]],"date-time":"2018-07-31T00:00:00Z","timestamp":1532995200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Recent public disclosures on attacks targeting the power industry showed that savvy attackers are now capable of occulting themselves from conventional rule-based network intrusion detection systems (IDS), bringing about serious threats. In order to leverage the work of rule-based IDS, this paper presents an artificially intelligent physical-model-checking intrusion detection framework capable of detecting tampered-with control commands from control centers of power grids. Unlike the work presented in the literature, the work in this paper utilizes artificial intelligence (AI) to learn the load flow characteristics of the power system and benefits from the fast responses of the AI to decode and understand contents of network packets. The output of the AI is processed through an expert system to verify that incoming control commands do not violate the physical system operational constraints and do not put the power system in an insecure state. The proposed content-aware IDS is tested in simulation on a 14-bus IEEE benchmark system. Experimental verification on a small power system, with an IEC 61850 network architecture is also carried out. The results showed the accuracy of the proposed framework in successfully detecting malicious and\/or erroneous control commands.<\/jats:p>","DOI":"10.3390\/s18082478","type":"journal-article","created":{"date-parts":[[2018,8,1]],"date-time":"2018-08-01T03:10:01Z","timestamp":1533093001000},"page":"2478","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":7,"title":["Physical-Model-Checking to Detect Switching-Related Attacks in Power Systems"],"prefix":"10.3390","volume":"18","author":[{"given":"Mohamad","family":"El Hariri","sequence":"first","affiliation":[{"name":"Energy Systems Research Laboratory, Department of Electrical and Computer Engineering, Florida International University, Miami, FL 33174, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Samy","family":"Faddel","sequence":"additional","affiliation":[{"name":"Energy Systems Research Laboratory, Department of Electrical and Computer Engineering, Florida International University, Miami, FL 33174, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2586-4046","authenticated-orcid":false,"given":"Osama","family":"Mohammed","sequence":"additional","affiliation":[{"name":"Energy Systems Research Laboratory, Department of Electrical and Computer Engineering, Florida International University, Miami, FL 33174, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2018,7,31]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"163","DOI":"10.1109\/TSG.2016.2547742","article-title":"Runtime Semantic Security Analysis to Detect and Mitigate Control-related Attacks in Power Grids","volume":"9","author":"Lin","year":"2018","journal-title":"IEEE Trans. Smart Grid"},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"El Hariri, M., Youssef, T.A., Habib, H., and Mohammed, O.A. (2017, January 23\u201326). Online False Data Detection and Lost Packet Forecasting System Using Time Series Neural Networks for IEC 61850 Sampled Measured Values. Proceedings of the IEEE PES Innovative Smart Grid Technologies North America, Washington, DC, USA.","DOI":"10.1109\/ISGT.2017.8086005"},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"2340","DOI":"10.1109\/TIFS.2014.2363786","article-title":"Resilience Analysis of Power Grids under the Sequential Attack","volume":"9","author":"Zhu","year":"2014","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"3274","DOI":"10.1109\/TPDS.2013.2295814","article-title":"Revealing Cascading Failure Vulnerability in Power Grids Using Risk-Graph","volume":"25","author":"Zhu","year":"2014","journal-title":"IEEE Trans. Parallel Distrib. Syst."},{"key":"ref_5","unstructured":"Falliere, N., Murchu, L.O., and Chein, E. (2011). W32.Stuxnet Dossier, Symantic Security Response Report, Version 1.4, Symantec Corporation."},{"key":"ref_6","unstructured":"DRAGOS Inc. (2017). Crashoverride: Analyses of the Threat to Electric Grid Operation, DRAGOS Inc.. Report Version 2.20170613."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"El Hariri, M., Youssef, T.A., and Mohammed, O.A. (2016). On the Implementation of the IEC 61850 Standard: Will Different Manufacturer Devices Behave Similarly under Identical Conditions?. Electronics, 5.","DOI":"10.3390\/electronics5040085"},{"key":"ref_8","unstructured":"Hariri, M.E., Harmon, E., Habib, H.F., Youssef, T., and Mohammed, O.A. (2017, January 17\u201320). A targeted attack for enhancing resiliency of intelligent intrusion detection modules in energy cyber physical systems. Proceedings of the 2017 19th International Conference on Intelligent System Application to Power Systems (ISAP), San Antonio, TX, USA."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"150","DOI":"10.1109\/TPWRD.2017.2669110","article-title":"Bad Data Detection Using Linear WLS and Sampled Values in Digital Substations","volume":"33","author":"Wu","year":"2018","journal-title":"IEEE Trans. Power Deliv."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"2693","DOI":"10.1109\/TII.2017.2656905","article-title":"Detection of False-Data Injection Attacks in Cyber-Physical DC Microgrids","volume":"13","author":"Beg","year":"2017","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"3299","DOI":"10.1109\/TII.2017.2740324","article-title":"Ensuring Data Integrity of OPF Module and Energy Database by Detecting Changes in Power Flow Patterns in Smart Grids","volume":"13","author":"Anwar","year":"2017","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Ruan, J., Wang, H., Aziz, S., Wang, G., Zhou, B., and Fu, X. (2017, January 26\u201328). Interval state estimation based defense mechanism against cyber attack on power systems. Proceedings of the 2017 IEEE Conference on Energy Internet and Energy System Integration (EI2), Beijing, China.","DOI":"10.1109\/EI2.2017.8245264"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"3271","DOI":"10.1109\/TII.2018.2825243","article-title":"Online False Data Injection Attack Detection with Wavelet Transform and Deep Neural Networks","volume":"14","author":"Yu","year":"2018","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"580","DOI":"10.1109\/TSG.2014.2298195","article-title":"Model-Based Attack Detection and Mitigation for Automatic Generation Control","volume":"5","author":"Sridhar","year":"2014","journal-title":"IEEE Trans. Smart Grid"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"436","DOI":"10.1109\/TII.2016.2612645","article-title":"Multi-Agent Approach for Enhancing Security of Protection Schemes in Cyber-Physical Energy Systems","volume":"13","author":"Rahman","year":"2017","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Rahman, M.S., Pota, H.R., and Hossain, M.J. (2014, January 27\u201331). Cyber vulnerabilities on agent-based smart grid protection system. Proceedings of the 2014 IEEE PES General Meeting | Conference Exposition, National Harbor, MD, USA.","DOI":"10.1109\/PESGM.2014.6939298"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Giani, A., Bitar, E., Garcia, M., McQueen, M., Khargonekar, P., and Poolla, K. (2011, January 17\u201320). Smart grid data integrity attacks: Characterizations and countermeasures\u03c0. Proceedings of the 2011 IEEE International Conference on Smart Grid Communications (SmartGridComm), Brussels, Belgium.","DOI":"10.1109\/SmartGridComm.2011.6102324"},{"key":"ref_18","unstructured":"American National Standards Institute (2006). American National Standard for Electrical Power Systems and Equipment, ANSI C84.1-2006, Voltage Ratings (60 Hertz), American National Standards Institute."},{"key":"ref_19","unstructured":"Mangoon, R. (2017). Transmission Planning Guidelines (Revision 1), Orange and Rockland Transmission and Substation Engineering Department."},{"key":"ref_20","unstructured":"Fuloria, S., and Anderson, R. (2010, January 18\u201319). The Protection of Substation Communications. Proceedings of the SCADA Security Symposium, Miami, FL, USA."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"TYoussef, A., Hariri, M.E., Bugay, N., and Mohammed, O.A. (2016, January 7\u201310). IEC 61850: Technology standards and cyber-threats. Proceedings of the 2016 IEEE 16th International Conference on Environment and Electrical Engineering (EEEIC), Florence, Italy.","DOI":"10.1109\/EEEIC.2016.7555647"},{"key":"ref_22","unstructured":"(2017, July 28). Data Sheet for IEEE 14 Bus System. Available online: http:\/\/shodhganga.inflibnet.ac.in\/bitstream\/10603\/5247\/18\/19_appendix.pdf."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"1394","DOI":"10.1109\/TSG.2012.2194518","article-title":"Laboratory-Based Smart Power System, Part I: Design and System Development","volume":"3","author":"Salehi","year":"2012","journal-title":"IEEE Trans. Smart Grid"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"1405","DOI":"10.1109\/TSG.2012.2194519","article-title":"Laboratory-Based Smart Power System, Part II: Control, Monitoring, and Protection","volume":"3","author":"Salehi","year":"2012","journal-title":"IEEE Trans. Smart Grid"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/18\/8\/2478\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T15:15:37Z","timestamp":1760195737000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/18\/8\/2478"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018,7,31]]},"references-count":24,"journal-issue":{"issue":"8","published-online":{"date-parts":[[2018,8]]}},"alternative-id":["s18082478"],"URL":"https:\/\/doi.org\/10.3390\/s18082478","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2018,7,31]]}}}