A Hybrid ML-Digital Twin Framework for Differentiating Cyberattacks from Legitimate Price Fluctuations in Electricity Markets

The increasing digitization of electricity markets has made them vulnerable to cyberattacks that can manipulate market prices and disrupt grid operations. Traditional methods struggle to differentiate between real market price and cyberinduced anomalies, leading to inaccurate responses and financial instability. This paper proposes a hybrid detection framework that integrates a support vector machine (SVM) classifier with a real-time digital twin simulation to enhance cyberattack detection in electricity markets. The SVM model is trained on historical electricity market data, incorporating key features such as power flow, voltage levels, frequency, and electricity prices. It classifies anomalies into normal operations, real congestion, or cyberattacks. The digital twin model simulates expected market behavior, enabling a discrepancybased verification mechanism that compares real-time market conditions with simulated predictions to detect market manipulation attacks. Unlike traditional grid-monitoring methods that primarily focus on physical anomalies, this framework integrates real-time digital twin simulations with machine learning-based classification to differentiate cyberinduced market manipulations from genuine operational fluctuations. The proposed hybrid approach enhances cybersecurity by detecting false data injection (FDI) attacks targeting electricity prices while minimizing false alarms. This ensures improved market stability, secure decision-making for operators, and enhanced grid resilience against cyber threats.