Summary
Fault detection in smart grids is increasingly complicated by the convergence of power systems and digital communication networks, where physical faults and cyberattacks often exhibit similar operational signatures. This paper proposes a novel autonomous cyber-physical fault detection and response framework that explicitly integrates the Industrial Control System (ICS)
Read more Read lessKill Chain into AI-based diagnostics.
The core contribution is a hybrid architecture combining deep learning with Large Language
Models (LLMs). It captures high-dimensional spatiotemporal patterns in time-series electrical measurements and IEC 61850 GOOSE traffic under noisy and highly imbalanced conditions.
LLMs provide context-aware reasoning, cross-layer correlation, and systematic mapping of anomalies to specific ICS Kill Chain stages. This enables both accurate classification of physical, cyber, and hybrid events and explainable diagnosis of attack progression.
Furthermore, the framework introduces AI-driven incident response planning with safety constraints and human-in-the-loop oversight, advancing beyond static, IT-centric playbooks.
Validation on IEEE 39-bus simulations and realistic GOOSE attack scenarios demonstrates improved situational awareness and practical applicability for resilient digital substations.
Additional informations
| Publication type | Session Materials |
|---|---|
| Reference | D2_10883_2026 |
| Publication year | |
| Publisher | CIGRE |
| Country | United States of America |
| Study committees | |
| File size | 658 KB |
| Price for non member | 30 € |
| Price for member | 30 € |
Authors
JOHN Rocky - Siemens Energy, United States of America; GOWDANAKATTE Shwetha - Siemens Energy, United States of America; KAYA Yusuf - Siemens Energy, Germany; PILAKKAL Sreejith - Siemens Energy, Germany
Keywords
Artificial Intelligence - Deep Learning - Cyber Attack - Fault Detection - ICS Kill Chain
