Zero-trust cybersecurity framework for AI-driven Energy Internet and smart grid systems

The Energy Internet extends the classical power grid into a densely interconnected system of distributed energy resources, advanced metering infrastructure, and machine-learning-driven control loops, and this extension enlarges the attack surface at the same rate that it improves efficiency. Perimeter-based security models, which implicitly trust any device or control message that has already crossed the substation firewall, are a poor match for this environment because a compromised remote terminal unit or a spoofed measurement stream sits, by construction, inside the perimeter. This paper develops a zero-trust cybersecurity framework for AI-driven Energy Internet and smart grid systems that treats every measurement, device, and control action as unverified until it is continuously re-evaluated. The framework combines four elements: a continuous trust-score recursion with an evidence-driven decay dynamic; an artificial-intelligence risk engine that fuses residual-based anomaly scores with a federated-learning classifier trained across substations without centralising raw telemetry; a tiered false-data-injection detector that partitions the network into observability zones and exploits tie-line flow measurements the attacker does not control, building on and extending an existing tiered detection and distributed partitioning method; and a policy decision engine, formalised as a Stackelberg game between defender and attacker, that converts trust and risk scores into access decisions. The framework is evaluated through reproducible simulations on the IEEE 14-, 30-, and 118-bus test systems, using a from-scratch alternating-current weighted least squares state estimator, physically grounded false-data-injection attacks restricted to a realistic compromised-measurement subset, and extensive Monte Carlo campaigns on each system. The results show a sharp, theoretically predicted transition in detectability governed by the ratio between the number of measurements an attacker controls and the redundancy of the measurement set; a consistent detection advantage for the tiered partitioned detector precisely in the narrow operating region attackers would rationally target; area under the receiver operating characteristic curve above 0.98 for the combined detector across all three test systems; sub-second state-estimation solve times even on the 118-bus system; and a trust-score policy engine whose false-revocation rate and detection delay trade off predictably with the memory parameter of the trust recursion.