AI-Driven Anomaly Detection in Modern Power Systems

The rapid digitalization of power systems has introduced cybersecurity challenges that demand innovative protection strategies. This dissertation addresses critical vulnerabilities in two essential domains of modern power systems: IEC61850-based digital substations and energy management systems (EMSs). Current artificial intelligence (AI)-based anomaly detection (AD) approaches face significant limitations in identifying emerging zero-day threats and managing computational burdens, while the shortage of comprehensive datasets further obstructs the development of robust detection solutions. This research presents novel generative AI (GenAI)-based AD frameworks that overcome these fundamental challenges through advanced synthetic data generation, semantic understanding, and multimodal analysis capabilities. Hence, AD and data generation techniques for IEC61850-compliant digital substations are proposed to address the critical shortage of realistic multicast message datasets and the inability of traditional systems to detect unknown attack patterns. The Advanced Adversarial Traffic Mutation (AATM) technique employs sophisticated perturbation and mutation strategies to generate protocol-compliant synthetic datasets, achieving a good balance rate (BR) compared to conventional approaches. The research further presents innovative detection architectures, which leverage GenAI capabilities by integrating semantic rule processing with contextual understanding. These systems demonstrate exceptional reliability in distinguishing between legitimate operational changes and malicious activities, establishing new benchmarks for substation security. Furthermore, this research introduces a comprehensive multi-point attack model that recognizes how modern cyberattacks/errors exploit multiple system layers simultaneously, from state estimation (SE) to human-machine interfaces (HMIs). The proposed GenAI-based anomaly detection systems (ADSs), including the Set-of-Mark Guided Generative Intelligence (SoM-GI) methodology, present a significant advancement, combining visual markers with linguistic rule processing to address spatial reasoning limitations inherent in current systems. These contributions establish practical, applicable solutions that enhance the resilience of critical energy infrastructure against emerging security vulnerabilities.