Integrating Cyber and Physical Analysis for Intrusion Detection in Plant-Level DER Microgrids

The growing use of distributed energy resources (DERs) is reshaping the energy industry by enabling a more decentralized and sustainable energy ecosystem. However, integrating these technologies with the electric grid heavily relies on communication systems, thereby exposing them to heightened cybersecurity threats, and so does the necessity for robust cybersecurity measures. This paper presents a hybrid Intrusion Detection System (IDS) that utilizes data from three critical sources: host devices, network traffic, and physical power system measurements, to provide accurate detection of cyber threats. The IDS is specifically designed to detect anomalies in inverter-based DER systems that utilize the Modbus protocol. Each of the three analysis engines has a set of rules that serve as signatures to identify abnormalities. The implementation leverages open-source tools, ensuring flexibility and ease of integration into existing systems. A laboratory-scale microgrid test bed that resembles a hospital microgrid environment is used to validate the proposed IDS. A comprehensive set of test scenarios that encompass realistic and practical circumstances is used to evaluate the efficacy of the IDS. The findings show that the proposed IDS achieved 100% detection accuracy with an average response time of <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\leq$</tex-math></inline-formula> 1.5 seconds, demonstrating high performance and cost-effective deployment on resource-constrained hardware.