Enhanced cybersecurity for digital substations: a hybrid SDN-IDS with active threat mitigation and fault localization

The increasing digitalization of substations leaves key power infrastructure with more vulnerability to cyberattacks. We present a more advanced model of cybersecurity that can be used in digital substations and propose it as an alternative to the current model in this paper. Unlike the existing literature, which is more of an isolated detection model or protocol-specific vulnerability, Our solution combines multi-feature attack detection and performs an adaptive weighting to obtain the full accuracy and robustness against evolving threats. It has been demonstrated that the system achieves higher detection rates and lower false positive rates than state-of-the-art on a variety of experiments using typical attack scenarios. Beyond this, the framework addresses practical deployment challenges with scalability, interoperability and smart grid standards. The value of this work lies in a complete solution to address the literature gap between theory and the practical needs of cybersecurity in digital substations.