AI-based Attacker Models for Enhancing Multi-Stage Cyberattack Simulations in Smart Grids Using Co-Simulation Environments

TL;DR

This paper introduces a co-simulation framework with autonomous agents for generating realistic cyberattack data on smart grids, aiding security research and testing without relying on limited real-world data.

Contribution

It presents a novel co-simulation environment with autonomous attack agents and explores large language models for attack automation, enhancing data generation for smart grid cybersecurity.

Findings

Virtual attacks in co-simulation match physical lab impacts

Autonomous agents enable flexible, reproducible attack scenarios

Large language models currently unreliable for attack automation

Abstract

The transition to smart grids has increased the vulnerability of electrical power systems to advanced cyber threats. To safeguard these systems, comprehensive security measures-including preventive, detective, and reactive strategies-are necessary. As part of the critical infrastructure, securing these systems is a major research focus, particularly against cyberattacks. Many methods are developed to detect anomalies and intrusions and assess the damage potential of attacks. However, these methods require large amounts of data, which are often limited or private due to security concerns. We propose a co-simulation framework that employs an autonomous agent to execute modular cyberattacks within a configurable environment, enabling reproducible and adaptable data generation. The impact of virtual attacks is compared to those in a physical lab targeting real smart grids. We also investigate the use of large language models for automating attack generation, though current models on consumer hardware are unreliable. Our approach offers a flexible, versatile source for data generation, aiding in faster prototyping and reducing development resources and time.