Elevating Cybersecurity for Smart Grid Systems—A Container-Based Approach Enhanced by Machine Learning

This paper presents a comprehensive implementation of a cybersecurity solution for smart grid network containers. The methodology utilises (i) Qualys API-based vulnerability scanning and reporting system for vulnerability identification, (ii) Docker deployment for security and isolation, (iii) advanced load balancing techniques for resource optimisation, and (iv) machine learning-powered anomaly detection for threat identification and vulnerability prioritisation. The implementation was used to create a dataset that continues the details of several simulated attacks, enabling effective training and evaluation of a robust machine-learning model. The paper provides a thorough description of the implemented system architecture, the Qualys API-based vulnerability scanning and reporting system, the data set creation process, simulated attacks in Docker implementation, the load balancing process, and the machine learning model used for vulnerability prioritisation. The experiments showed that the machine learning model performed exceptionally well across all conducted attacks i.e., Denial of Service, Remote-to-Local, User-to-Root, and Probes, achieving high scores in accuracy, precision, recall, and F1 scores.

I. Introduction

In 2023, the number of cybersecurity attacks witnessed a significant surge, highlighting the pressing need to safeguard critical infrastructure from these detrimental incidents. The study conducted by [1] Reveals that the frequency of cyber-attacks escalated over the examined period. In 2018, there were 1,554 reported attacks, which increased to 1,667 in 2019, and further rose to 1,867 in 2020, reflecting a growth rate of approximately 17% between 2018 and 2020. Consequently, with the constant advances in cyber-attacks, it is imperative to establish robust mechanisms for detecting threats and safeguarding infrastructure. The field of cybersecurity in smart grid systems has been the subject of extensive research. The study by [2] presented a comprehensive examination of cybersecurity in smart grids highlighting prevalent security risks but overlooking container vulnerabilities. Similarly, [3] survey cybersecurity methods but lack a detailed analysis of container intricacies. On the other hand, [4] presents a smart grid security case study, which overlooks container vulnerabilities. The research conducted by [5] explored cybersecurity issues in smart grid communications, briefly mentioning container security. However, their investigation into container vulnerabilities was limited.