arXiv subjects

Ioannis Zografopoulos

Publications and source records attributed to Ioannis Zografopoulos.

At least 19 recordsLinked to original sources

arXiv2026

Technical Report on Resilient and Secure Large-Scale Energy Internet Systems

This IEEE PES Task Force report examines the security and resilience of large-scale Energy Internet (EI) systems, in which electricity, information, and market layers are tightly coupled through pervasive digitalization. The report characterizes the EI cyber-physical threat landscape and surveys detection, assurance, and mitigation techniques, presents modeling, control, and decision-making frameworks that capture cyber-physical interdependencies, including storage integration, multi-dimensional resilience, and electricity price forecasting, examines adversarial risks and trustworthy deployment of artificial intelligence, and introduces graph-based, attack-resilient information routing. The report closes with recommendations for research, standardization, and regulatory efforts needed to realize a resilient and secure large-scale EI.

eess.SY↗

arXiv2026

Economic Impact Assessment of Denial-of-Service and Time-Delay Attacks on Advanced Metering Infrastructure

Advanced Metering Infrastructure (AMI) plays an important role in modern power systems by providing near real-time consumption data for operational planning and load estimation. Despite this, AMI communication networks are vulnerable to certain cyberattack types, such as denial-of-service (DoS) and time delay attacks (TDAs), which may compromise data availability. This paper evaluates the impact of these attack types on AMI communication using a Mininet-based simulation environment that implements a communication model inspired by the Distributed Network Protocol 3 (DNP3) for communication among smart meters, data concentrators, and utility systems. Different cyberattack scenarios are analyzed, including communication delay, packet loss, combined degradation rate (D_rate), and concentrator failure, to evaluate their effects on network performance and data availability. The results indicate increased latency, higher communication unavailability rates, and reduced data reliability under attack conditions. In addition, the study correlates how communication degradation can result in potential uncertainties in energy demand estimation and provides estimates of the associated financial impacts on energy procurement, using electricity pricing data from the Independent System Operator-New England (ISO-NE). The experimental results reveal that a 500 ms delay increased the average RTT (Round-trip time) from 0.22 ms to 69.5 ms, while a 50% packet loss scenario resulted in 87 timeout events and a 5.31% communication degradation rate. Under a regional-scale deployment of 10,000 smart meters, this degradation could cause an estimated economic impact of $1,009/day under normal market conditions and up to $5,097/day during high-price events.

eess.SY↗

arXiv2026

QUIC-TRIP: A Triple-Redundant Journey Toward Secure Substation Communications

Modern power systems rely on real-time substation communication protocols, such as the Routable Generic Object-Oriented Substation Event (R-GOOSE), for critical control and protection functions. However, these protocols often lack built-in security features and prioritize availability over confidentiality and integrity, making them susceptible to false data injection and denial-of-service attacks. This vulnerability is exacerbated when communications are transmitted over wide-area or public networks. Addressing these cyber threats is essential to comply with current security mandates, including the DOE's defense-in-depth and zero-trust guidelines. This paper introduces QUIC-TRIP, a transparent security methodology for low-latency IP-based industrial communications. By operating at the Open Systems Interconnection (OSI) Transport Layer (Layer 4), the solution encapsulates and protects data flows without affecting the operation of existing protocol endpoints. Baseline echo Round-Trip Time (RTT) results over a Frankfurt-Amsterdam communication path show that the underlying transport-layer proxy used by QUIC-TRIP achieves a lower average RTT than OpenVPN and only 2.88% higher average RTT than integrated DTLS 1.2, even with DTLS session reuse. We evaluate the resilience of QUIC-TRIP multipath communication under DoS flooding by securing R-GOOSE communications. In these tests, traffic is transparently delivered through three different paths, and QUIC-TRIP forwards the earliest-arriving duplicate while discarding later copies. The framework provides a triple-redundant defense scheme with a measured communication overhead of 32.18% per enabled proxied path, offering a bounded trade-off between resilience and bandwidth cost for time-critical grid operations.

cs.CR↗

arXiv2026

Resilience Revisited: A Multidimensional Framework Derived from Realistic Attack Scenarios

The increasing penetration of inverter-based resources exposes power systems to coordinated cyber-physical attacks capable of triggering cascading failures and systemic instability. However, existing resilience indicators assess each dimension independently, preventing the quantification of how interdimensional coupling amplifies resilience loss during high-impact, low-probability events. This paper presents a Multidimensional Resilience Index (MDRI) that quantifies degradation across the physical, operational, cyber-digital, climatic, and regulatory dimensions, explicitly distinguishing the independent contribution of each dimension from the additional loss caused by their interactions. The proposed framework is validated on the IEEE 39-bus system implemented in MATLAB/Simulink through two attack scenarios reconstructed from the December 2025 cyberattack on the Polish power grid: a baseline scenario with a single compromised power plant and a coordinated multivector attack. The latter causes system collapse and increases resilience loss nearly eightfold relative to the baseline solely through interdimensional coupling. Including climatic and regulatory stressors produces a further 84% increase, yielding an overall resilience loss nearly fifteen times greater. These findings demonstrate that multidimensional coupling is a dominant driver of resilience degradation and that resilience assessment must explicitly account for interdependencies among dimensions to reveal vulnerabilities overlooked by conventional approaches.

eess.SY↗

arXiv2026

Multidimensional Resilience for Electrical Power Systems: Systematic Review, Integrated Index, and Validation under Real-World Cyber-Physical Attack Scenarios

The accelerating decarbonization of energy systems has transformed electrical power systems into complex infrastructures exposed to threats whose interactions generate systemic vulnerabilities that conventional resilience approaches fail to capture. Although resilience assessment has expanded across multiple dimensions, existing studies largely examine them in isolation or adjacent pairs, leaving cross-dimensional couplings insufficiently explored. This study demonstrates i) that single-dimension assessments fail to capture the degradation produced by simultaneous cross-dimensional failures, ii) the nonlinear amplification emerging when physical, operational, and digital-cyber dimensions are jointly compromised, and iii) the intensification imposed by climatic and economic-regulatory stressors. To this end, we leverage a hybrid quantitative methodology. A PRISMA 2020 review with backward and forward snowballing identifies methodological gaps and unresolved dependencies across five resilience dimensions: physical, operational, digital-cyber, climatic-external, and economic-regulatory. Following this analysis, a Multidimensional Resilience Index (MDRI) is developed to capture endogenous couplings and exogenous amplification effects and is validated under escalating cyber-physical attack scenarios inspired by the December 2025 attack on Polish energy infrastructure. Results show that degradation under cascading and simultaneous failures is nearly eight times greater than under isolated stress, while exogenous conditions amplify degradation by an additional factor approaching six, with 72% of this amplification driven by exogenous stressors. Combined, these mechanisms produce a 46-fold increase in resilience loss compared to a single-vector reference.

eess.SY↗

arXiv2026

Impact Assessment of Cyberattacks in Inverter-Based Microgrids

In recent years, the evolution of modern power grids has been driven by the growing integration of remotely controlled grid assets. Although Distributed Energy Resources (DERs) and Inverter-Based Resources (IBRs) enhance operational efficiency, they also introduce cybersecurity risks. The remote accessibility of such critical grid components creates entry points for attacks that adversaries could exploit, posing threats to the stability of the system. To evaluate the resilience of energy systems under such threats, this study employs real-time simulation and a modified version of the IEEE 39-bus system that incorporates a Microgrid (MG) with solar-based IBR. The study assesses the impact of remote attacks impacting the MG stability under different levels of IBR penetration through hardware-in-the-loop (HIL) simulations. Namely, we analyze voltage, current, and frequency profiles before, during, and after cyberattack-induced disruptions. The results demonstrate that real-time HIL testing is a practical approach to uncover potential risks and develop robust mitigation strategies for resilient MG operations.

eess.SY↗

arXiv2025

Event-Triggered Islanding in Inverter-Based Grids

The decentralization of modern power systems challenges the hierarchical structure of the electric grid and necessitates automated schemes to manage adverse conditions. This work proposes an adaptive isolation methodology that can divide a grid into autonomous islands, ensuring stable and economical operation amid deliberate or unintentional abnormal events. The adaptive isolation logic is event-triggered to prevent false positives, enhance detection accuracy, and reduce computational overhead. A measurement-based stable kernel representation (SKR) triggering mechanism initially inspects distributed generation controllers for abnormal behavior. The SKR then alerts an ensemble classifier to assess whether the system behavior remains within acceptable operational limits. The event-triggered adaptive isolation framework is evaluated using IEEE RTS-24 and 118-bus systems. Simulation results demonstrate that the proposed framework detects anomalous behavior with 100% accuracy in real-time, i.e., within 22msec. Supply-adequate partitions are identified outperforming traditional islanding detection and formation techniques while minimizing operating costs.

eess.SY↗

arXiv2023

Distributed Energy Resources Cybersecurity Outlook: Vulnerabilities, Attacks, Impacts, and Mitigations

The digitization and decentralization of the electric power grid are key thrusts for an economically and environmentally sustainable future. Towards this goal, distributed energy resources (DER), including rooftop solar panels, battery storage, electric vehicles, etc., are becoming ubiquitous in power systems. Power utilities benefit from DERs as they minimize operational costs; at the same time, DERs grant users and aggregators control over the power they produce and consume. DERs are interconnected, interoperable, and support remotely controllable features, thus, their cybersecurity is of cardinal importance. DER communication dependencies and the diversity of DER architectures widen the threat surface and aggravate the cybersecurity posture of power systems. In this work, we focus on security oversights that reside in the cyber and physical layers of DERs and can jeopardize grid operations. Existing works have underlined the impact of cyberattacks targeting DER assets, however, they either focus on specific system components (e.g., communication protocols), do not consider the mission-critical objectives of DERs, or neglect the adversarial perspective (e.g., adversary/attack models) altogether. To address these omissions, we comprehensively analyze adversarial capabilities and objectives when manipulating DER assets, and then present how protocol and device-level vulnerabilities can materialize into cyberattacks impacting power system operations. Finally, we provide mitigation strategies to thwart adversaries and directions for future DER cybersecurity research.

cs.CR↗

arXiv2023

Experimental Impact Analysis of Cyberattacks in Power Systems using Digital Real-Time Testbeds

Smart grid advancements and the increased integration of digital devices have transformed the existing power grid into a cyber-physical energy system. This reshaping of the current power system can make it vulnerable to cyberattacks, which could cause irreversible damage to the energy infrastructure resulting in the loss of power, equipment damage, etc. Constant threats emphasize the importance of cybersecurity investigations. At the same time, developing cyber-physical system (CPS) simulation testbeds is crucial for vulnerability assessment and the implementation and validation of security solutions. In this paper, two separate real-time CPS testbeds are developed based on the availability of local research facilities for impact analysis of denial-of-service (DoS) attacks on microgrids. The two configurations are implemented using two different digital real-time simulator systems, one using the real-time digital simulator (RTDS) with a hardware-in-the-loop (HIL) setup and the other one using OPAL-RT with ExataCPS to emulate the cyber-layer infrastructure. Both testbeds demonstrate the impact of DoS attacks on microgrid control and protection operation.

eess.SY↗

arXiv2022

A Resource Allocation Scheme for Energy Demand Management in 6G-enabled Smart Grid

Smart grid (SG) systems enhance grid resilience and efficient operation, leveraging the bidirectional flow of energy and information between generation facilities and prosumers. For energy demand management (EDM), the SG network requires computing a large amount of data generated by massive Internet-of-things sensors and advanced metering infrastructure (AMI) with minimal latency. This paper proposes a deep reinforcement learning (DRL)-based resource allocation scheme in a 6G-enabled SG edge network to offload resource-consuming EDM computation to edge servers. Automatic resource provisioning is achieved by harnessing the computational capabilities of smart meters in the dynamic edge network. To enforce DRL-assisted policies in dense 6G networks, the state information from multiple edge servers is required. However, adversaries can "poison" such information through false state injection (FSI) attacks, exhausting SG edge computing resources. Toward addressing this issue, we investigate the impact of such FSI attacks with respect to abusive utilization of edge resources, and develop a lightweight FSI detection mechanism based on supervised classifiers. Simulation results demonstrate the efficacy of DRL in dynamic resource allocation, the impact of the FSI attacks, and the effectiveness of the detection technique.

cs.NI↗

arXiv2022

Mitigation of Cyberattacks through Battery Storage for Stable Microgrid Operation

In this paper, we present a mitigation methodology that leverages battery energy storage system (BESS) resources in coordination with microgrid (MG) ancillary services to maintain power system operations during cyberattacks. The control of MG agents is achieved in a distributed fashion, and once a misbehaving agent is detected, the MG's mode supervisory controller (MSC) isolates the compromised agent and initiates self-healing procedures to support the power demand and restore the compromised agent. Our results demonstrate the practicality of the proposed attack mitigation strategy and how grid resilience can be improved using BESS synergies. Simulations are performed on a modified version of the Canadian urban benchmark distribution model.

eess.SY↗

arXiv2022

Behind Closed Doors: Process-Level Rootkit Attacks in Cyber-Physical Microgrid Systems

Embedded controllers, sensors, actuators, advanced metering infrastructure, etc. are cornerstone components of cyber-physical energy systems such as microgrids (MGs). Harnessing their monitoring and control functionalities, sophisticated schemes enhancing MG stability can be deployed. However, the deployment of `smart' assets increases the threat surface. Power systems possess mechanisms capable of detecting abnormal operations. Furthermore, the lack of sophistication in attack strategies can render them detectable since they blindly violate power system semantics. On the other hand, the recent increase of process-aware rootkits that can attain persistence and compromise operations in undetectable ways requires special attention. In this work, we investigate the steps followed by stealthy rootkits at the process level of control systems pre- and post-compromise. We investigate the rootkits' precompromise stage involving the deployment to multiple system locations and aggregation of system-specific information to build a neural network-based virtual data-driven model (VDDM) of the system. Then, during the weaponization phase, we demonstrate how the VDDM measurement predictions are paramount, first to orchestrate crippling attacks from multiple system standpoints, maximizing the impact, and second, impede detection blinding system operator situational awareness.

eess.SY↗

arXiv2021

Consumer, Commercial and Industrial IoT (In)Security: Attack Taxonomy and Case Studies

Internet of Things (IoT) devices are becoming ubiquitous in our lives, with applications spanning from the consumer domain to commercial and industrial systems. The steep growth and vast adoption of IoT devices reinforce the importance of sound and robust cybersecurity practices during the device development life-cycles. IoT-related vulnerabilities, if successfully exploited can affect, not only the device itself, but also the application field in which the IoT device operates. Evidently, identifying and addressing every single vulnerability is an arduous, if not impossible, task. Attack taxonomies can assist in classifying attacks and their corresponding vulnerabilities. Security countermeasures and best practices can then be leveraged to mitigate threats and vulnerabilities before they emerge into catastrophic attacks and ensure overall secure IoT operation. Therefore, in this paper, we provide an attack taxonomy which takes into consideration the different layers of IoT stack, i.e., device, infrastructure, communication, and service, and each layer's designated characteristics which can be exploited by adversaries. Furthermore, using nine real-world cybersecurity incidents, that had targeted IoT devices deployed in the consumer, commercial, and industrial sectors, we describe the IoT-related vulnerabilities, exploitation procedures, attacks, impacts, and potential mitigation mechanisms and protection strategies. These (and many other) incidents highlight the underlying security concerns of IoT systems and demonstrate the potential attack impacts of such connected ecosystems, while the proposed taxonomy provides a systematic procedure to categorize attacks based on the affected layer and corresponding impact.

cs.CR↗

arXiv2021

Hardware-Assisted Detection of Firmware Attacks in Inverter-Based Cyberphysical Microgrids

The electric grid modernization effort relies on the extensive deployment of microgrid (MG) systems. MGs integrate renewable resources and energy storage systems, allowing to generate economic and zero-carbon footprint electricity, deliver sustainable energy to communities using local energy resources, and enhance grid resilience. MGs as cyberphysical systems include interconnected devices that measure, control, and actuate energy resources and loads. For optimal operation, cyberphysical MGs regulate the onsite energy generation through support functions enabled by smart inverters. Smart inverters, being consumer electronic firmware-based devices, are susceptible to increasing security threats. If inverters are maliciously controlled, they can significantly disrupt MG operation and electricity delivery as well as impact the grid stability. In this paper, we demonstrate the impact of denial-of-service (DoS) as well as controller and setpoint modification attacks on a simulated MG system. Furthermore, we employ custom-built hardware performance counters (HPCs) as design-for-security (DfS) primitives to detect malicious firmware modifications on MG inverters. The proposed HPCs measure periodically the order of various instruction types within the MG inverter's firmware code. Our experiments illustrate that the firmware modifications are successfully identified by our custom-built HPCs utilizing various machine learning-based classifiers.

cs.CR↗

arXiv2021

Security Assessment and Impact Analysis of Cyberattacks in Integrated T&D Power Systems

In this paper, we examine the impact of cyberattacks in an integrated transmission and distribution (T&D) power grid model with distributed energy resource (DER) integration. We adopt the OCTAVE Allegro methodology to identify critical system assets, enumerate potential threats, analyze, and prioritize risks for threat scenarios. Based on the analysis, attack strategies and exploitation scenarios are identified which could lead to system compromise. Specifically, we investigate the impact of data integrity attacks in inverted-based solar PV controllers, control signal blocking attacks in protective switches and breakers, and coordinated monitoring and switching time-delay attacks.

eess.SY↗

arXiv2021

Faster than Real-Time Simulation: Methods, Tools, and Applications

Real-time simulation enables the understanding of system operating conditions by evaluating simulation models of physical components running synchronized at the real-time wall clock. Leveraging the real-time measurements of comprehensive system models, faster than real-time (FTRT) simulation allows the evaluation of system architectures at speeds faster than real-time. FTRT simulation can assist in predicting the system's behavior efficiently, thus assisting the operation of system processes. Namely, the provided acceleration can be used for improving system scheduling, assessing system vulnerabilities, and predicting system disruptions in real-time systems. The acceleration of simulation times can be achieved by utilizing digital real-time simulators (RTS) and high-performance computing (HPC) architectures. FTRT simulation has been widely used, among others, for the operation, design, and investigation of power system events, building emergency management plans, wildfire prediction, etc. In this paper, we review the existing literature on FTRT simulation and its applications in different disciplines, with a particular focus on power systems. We present existing system modeling approaches, simulation tools and computing frameworks, and stress the importance of FTRT accuracy.

eess.SY↗

arXiv2021

eWake: A Novel Architecture for Semi-Active Wake-Up Radios Attaining Ultra-High Sensitivity at Extremely-Low Consumption

In this work we propose a new scheme for semi-passive Wake-Up Receiver circuits that exhibits remarkable sensitivity beyond -70 dBm, while state-of-the-art receivers illustrate sensitivity of up to -55 dBm. The receiver employs the typical principle of an envelope detector that harvests RF energy from its antenna, while it employs a nano-power operation amplifier to intensify the obtained signal prior to the final decoding that is realized with the aid of a comparator circuit. It operates at the 868 MHz ISM band using OOK signals propagated through LoRa transceivers, while also supporting addressing capabilities in order to awake only the specified network's nodes. The power expenditure of the developed receiver is as low as 580 nA, remaining at the same power consumption levels as the state-of-the-art implementations.

cs.AR↗

arXiv2021

Cyber-Physical Energy Systems Security: Threat Modeling, Risk Assessment, Resources, Metrics, and Case Studies

Cyber-physical systems (CPS) are interconnected architectures that employ analog, digital, and communication resources for their interaction with the physical environment. CPS are the backbone of enterprise, industrial, and critical infrastructure. Thus, their vital importance makes them prominent targets for malicious attacks aiming to disrupt their operations. Attacks targeting cyber-physical energy systems (CPES), given their mission-critical nature, can have disastrous consequences. The security of CPES can be enhanced leveraging testbed capabilities to replicate power system operations, discover vulnerabilities, develop security countermeasures, and evaluate grid operation under fault-induced or maliciously constructed scenarios. In this paper, we provide a comprehensive overview of the CPS security landscape with emphasis on CPES. Specifically, we demonstrate a threat modeling methodology to accurately represent the CPS elements, their interdependencies, as well as the possible attack entry points and system vulnerabilities. Leveraging the threat model formulation, we present a CPS framework designed to delineate the hardware, software, and modeling resources required to simulate the CPS and construct high-fidelity models which can be used to evaluate the system's performance under adverse scenarios. The system performance is assessed using scenario-specific metrics, while risk assessment enables system vulnerability prioritization factoring the impact on the system operation. The overarching framework for modeling, simulating, assessing, and mitigating attacks in a CPS is illustrated using four representative attack scenarios targeting CPES. The key objective of this paper is to demonstrate a step-by-step process that can be used to enact in-depth cybersecurity analyses, thus leading to more resilient and secure CPS.

cs.CR↗