A Protocol-Agnostic DER Intrusion Detection System using an IEEE 1547-Enabled Digital Twin

The U.S. power grid has undergone a significant transformation in recent years to incorporate more renewable energy systems and expand SCADA communication networks with modern digital components. The byproduct of these grid modernization efforts is an expanded cyber-physical attack surface that exposes several systems that could disrupt normal grid operation. To protect these systems, energy aware cyber-physical and network-based intrusion detection systems (NIDS) are needed. As opposed to simply alerting on malformed or malicious network traffic, our proposed NIDS can flag malicious packets or operations based on pre-configured normal grid operations. In this work, we propose accomplishing this complex task using a digital twin that is set up as a bump-in-the-wire NIDS between Distributed Energy Resources (DER) and a Distributed Energy Resources Management System (DERMS). The NIDS sniffs SunSpec Modbus and IEEE 2030.5 traffic and abstracts it to IEEE 1547-2018 compliant data through an EPRI Common DER Format. Afterwards, cyber-physical analysis, threat detection, and system protection is performed using a predefined physical ruleset that drops malicious traffic. Detailed analysis and evaluation regarding the operation of the digital twin is provided; the protocol-agnostic digital twin is capable of identifying stealthy cyber-physical attacks, i.e., False Data Injection Attacks due to an insider threat at the DERMS, within a simulated DER environment.