AI-Enabled Secure Digital Twin for Simulated Real-Time Stability Monitoring and Attack Detection in Smart Grid Infrastructure

Sammanfattning

Smart grids integrate communication networks, sensors, and automated controls to improve power system reliability and efficiency. However, this increased connectivity exposes grids to cyberattacks that can destabilize operations and compromise public safety. Among the most dangerous threats are False Data Injection (FDI) attacks, where adversaries manipulate measurement data to mislead system operators and trigger improper control actions. Detecting such attacks is challenging because manipulated data often remains within acceptable operating ranges, evading traditional thresholdbased detection methods. This study delivers an AI-enabled digital twin framework that addresses this challenge by combining real-time stability monitoring with attack detection. A digital twin is a virtual representation of a physical system that continuously synchronizes with real-time data. Here, an IEEE 14-bus power system—a standard benchmark model—is simulated using pandapower, an open-source Python-based tool, generating time-series voltage data under both normal and attack conditions. The XGBoost machine learning classifier is employed as the primary detection model due to its high efficiency and low computational requirements. Experimental results demonstrate that XGBoost detects FDI attacks with 97% accuracy, 96.2% precision, and 92.6% recall, significantly outperforming baseline methods such as Random Forest and Logistic Regression. When integrated into the digital twin framework, the system achieves a 100% attack detection rate with zero false alarms and an average detection latency of just 1.90 milliseconds— fast enough for real-time protective responses. These findings confirm that integrating digital twin technology with machine learning enables rapid, accurate anomaly detection, thereby enhancing grid resilience against cyber threats. For utility operators and grid engineers, this framework offers a practical, computationally efficient approach to cybersecurity monitoring without requiring complex infrastructure changes or expensive hardware upgrades.