Aanvals- en verdedigingsstrategieën in cyber-fysieke energiesystemen, gebaseerd op diepgaand leren

In pursuit of enhanced operational efficiency, accelerated decision-making, and cost-effectiveness, the widespread adoption of automation and smart technologies is driving the systemic digitalization and interconnection of critical infrastructures—most notably, Cyber-Physical Power Systems (CPPS). This transformation facilitates the integration of advanced control mechanisms, data-centric workflows, and real-time operational capabilities. While these advancements offer substantial benefits, they have simultaneously expanded the cyber threat landscape, increasing the exposure of both well-established systems (e.g., Operational Technology (OT) networks) and emerging systems (e.g., Internet of Things (IoT) networks) to sophisticated cyberattacks. The inherent heterogeneity of the system components, coupled with their dynamic and distributed operational characteristics and the adoption of diverse communication/security protocols, introduces substantial complexity in the development and deployment of robust cybersecurity strategies. Additionally, increasing concerns over data privacy and confidentiality impose constraints on data accessibility and analysis, diminishing the efficacy of traditional threat detection and mitigation mechanisms against increasingly complex and adaptive cyber threats. This growing concern around cybersecurity, particularly in CPPS, alongside rapid advancements in Artificial Intelligence (AI)—especially in Deep Learning (DL)—constitutes the primary motivation for the research conducted in this dissertation. This research systematically investigates the alternative-use characteristics of AI from an engineering perspective, emphasizing its potential to both enhance and undermine cybersecurity in CPPS. On one hand, this study demonstrates that advanced DL techniques can be exploited by adversarial entities to identify vulnerable system states and launch highly targeted cyberattacks. On the other hand, the findings also indicate that, when effectively utilized, these techniques possess substantial potential to enhance Anomaly Detection (AD) performance and facilitate faster, more adaptive defensive responses. Focusing more specifically on the methodological contributions, this study investigates the application of spatio-temporal pattern analysis in CPPS, with particular emphasis on cyber-layer indicators—such as network traffic patterns—as proxies for inferring system operational states and identifying anomalous behavior. Experimental results validate that timely and accurate interpretation of these patterns supports both offensive tactics and defensive strategies in CPPS environments. All models and methodologies developed in this study are meticulously designed to advance the systematic application of AI-driven approaches for elucidating and/or addressing emerging cybersecurity challenges in CPPS. To this end, advanced DL models are architected to accommodate the unique structural and operational complexities inherent to CPPS. Specifically, the study leverages various combinations of Graph Attention Networks (GAT), Convolutional Neural Networks (CNN), Long Short-Term Memory (LSTM), etc., selected and integrated based on contextual requirements. It is important to emphasize that, in designing DL architectures introduced in this dissertation, the objective extends beyond the mere combination of state-of-the-art DL models in a novel manner; rather, the main contribution lies in developing a purpose-built framework explicitly aimed at addressing multifaceted learning challenges posed by system heterogeneity, diverse communication topologies, and the necessity of extracting meaningful representations from complex spatio-temporal patterns and interdependencies. The Results and Discussion sections of this thesis encompass both qualitative analyses and quantitative evaluations, including key performance indicators such as attack success rate and AD accuracy. While the quantitative outcomes—reaching up to 99% accuracy in some scenarios—serve as useful performance benchmarks, the primary emphasis is placed on a critical examination of the specific challenges each algorithm addresses, the justification for their adoption in distinct system contexts, and their operational robustness and applicability. This analytical approach prioritizes a nuanced interpretation of each method's strengths and limitations, recognizing that performance metrics alone may be influenced by factors such as the quality or volume of the dataset. Given the substantial challenges and limitations in accessing real-world datasets—primarily due to confidentiality and data privacy considerations—the majority of the models and algorithms assessed in this study are developed and validated using synthetically generated (simulated) data. Nevertheless, the research also integrates a detailed analysis of emulated datasets (publicly available), which are rigorously examined, contextualized, and presented within the scope of this thesis.