Autonomous AI-Based Cyber Protection for Smart Transformers

As power grids undergo digital transformation, the integration of legacy power infrastructure with online condition monitoring systems (OLCM) and intelligent control platforms has enhanced operational efficiency. However, this interconnectivity has introduced new cybersecurity vulnerabilities. Power transformers, being central to grid reliability, are now increasingly exposed to cyber threats through their digitally integrated interfaces. Among the identified threats, False Data Injection Attacks (FDIA) are particularly severe, capable of stealthily manipulating monitoring data and control commands. These attacks can compromise system integrity, obscure fault conditions, and induce instability across the power grid. This study was motivated by three primary research questions: RQ1: What are the cybersecurity threats targeting power transformers, and how significant are they? RQ2: How can the most critical (i.e., highest significance as defined in RQ1) cyber threats be effectively detected in smart transformers? RQ3: How do system scalability and operational parameters affect the performance and generalisability of the proposed detection model? To address RQ1, this study established a transformer-specific threat model employing the STRIDE and MITRE ATT&CK frameworks. This model systematically mapped potential attack vectors, highlighting vulnerable components within transformer control, communication, and monitoring systems. By contextualising these threats within smart grid operations, this modelling effort lays a foundation for targeted defence strategies. In response to RQ2, a novel, AI-based intrusion detection algorithm was developed using a Temporal Convolutional Network (TCN) integrated with a Predictive Confidence Level (PCL) approach. This approach avoids reliance on system topologies by learning directly from time-series data, enabling effective detection, and differentiation between cyber attacks and benign system disturbances. The model was trained and validated using simulated attack data within a Real-Time Digital Simulator (RTDS), applied to the IEEE 14-bus. Evaluation metrics, including accuracy, precision, recall, and F1-score, demonstrated the model’s high detection performance, achieving 99% accuracy with markedly reduced false positives, thereby outperforming traditional and baseline machine learning models. Tackling RQ3, the model’s scalability was examined using the IEEE 39-bus system, incorporating both simulated attack scenarios and real-world utility load profiles. Results confirmed that the PCL-TCN model retained robust detection performance across varying network scales and configurations. Analysis of operational influences, including load variability and topology depth, demonstrated the model’s adaptability to larger, more complex environments, validating its suitability for deployment in practical grid settings. In developing the detection model, we faced the challenge of the lack of real-world labelled datasets for training and evaluation, a recognised limitation in the domain of power transformer cybersecurity. To address this, the study generated data via RTDS, supplemented with actual load profiles obtained from a local utility provider. This approach enabled realistic emulation of attack scenarios and enhanced the robustness and generalisability of the detection algorithm. Furthermore, the proposed adversarial taxonomy, informed by STRIDE and MITRE ATT&CK, not only mapped potential attack surfaces but also guided the simulation of realistic FDIA scenarios. In conclusion, this thesis offers a significant contribution to the field of smart grid cybersecurity by bridging theoretical threat analysis with data-driven, scalable detection model. The outcomes address a critical gap in transformer-focused cyber protection and provide utility operators with a practical, high-fidelity tool to enhance the resilience of digitally integrated power systems.