Real-Time Cyber Attack Detection and Response Using Digital Twins in Protection Relays

The transition from electromechanical relays to digital relays has potential to resolve many integration issues, particularly with protection schemes, especially after the adoption of International Electrotechnical Commission (IEC) 61850. However, IEC 61850 remains vulnerable to cyberattacks due to the time constraints involved in implementing integrity and authentication algorithms. This paper explores the application of digital twin technology in digital substations for the realtime detection and response to cyber attacks targeting protection relays. The digital twin is developed using low-level programming techniques to ensure rapid detection and timely response to security threats. The effectiveness of the digital twin was evaluated through testing against cyber attacks in a sample value scenario based on the IEC 61850 standard. The simulation was conducted using the OPAL-RT real-time power system simulator. The results demonstrate the capability of the digital twin to enhance cybersecurity measures by providing immediate detection and response to potential threats in protection relay systems.