Enhancing Cybersecurity in Power Substations through Active Immune Detection and Low-Load Network Security Risk Intelligence Platform

As the integration of Information and Communication Technologies (ICT) into power substations heightens the efficiency and reliability of power systems, it also markedly increases the vulnerability and exposure to cyberattacks. The power substation, a key component of the energy sector, encompasses a network of interdependent and interoperating cyberphysical systems (CPS) intricate in delivering electricity nationwide. With the consistent interconnection and communication among these systems, malicious actors have ampler opportunities to exploit access points in cyberspace and subsequently attack physical systems, posing substantial threats of cascading blackouts. To tackle these challenges, our research proposes an active immune detection method and a lowload network security risk intelligence platform. These technologies aim to strengthen the cybersecurity in power substations, thereby preventing massive electricity disruptions. The active immune detection identifies threats with less reliance on predefined rules or patterns, thus enabling more effective responses to unknown attacks. Meanwhile, the lowload platform analyzes big data from power networks to identify potential risks and trends. Both significantly serve to enhance the cyber resilience of power substations. Realworld incidences, research findings, and emerging concerns from various sectors substantiate the urgency of fortifying security in power substations.