AI-augmented cybersecurity for smart grids in the United States

 Corresponding author: Muhammad Faheem Copyright © 2025 Author(s) retain the copyright of this article. This article is published under the terms of the Creative Commons Attribution License 4.0. AI-augmented cybersecurity for smart grids in the United States Muhammad Faheem 1, *, Muhammad Awais 1, Aqib Iqbal 2 and Hasnain Zia 3 1 Department of Information Technology Management, Cumberland University, Tennessee, USA. 2 Department of Project Management, The University of Law, Birmingham, United Kingdom. 3 Department of Computer Science, COMSATS University Islamabad, Abbottabad Campus, Pakistan. World Journal of Advanced Research and Reviews, 2025, 27(01), 713-726 Publication history: Received on 22 May 2025; revised on 05 July 2025; accepted on 08 July 2025 Article DOI: https://doi.org/10.30574/wjarr.2025.27.1.2354 Abstract In this study, we look at using AI and ML to strengthen cybersecurity in the United States by resolving known weaknesses and coming up with a dependable and privacy-aware defense plan that follows the rules. Researching with federated learning, LSTM, and CNN in an AI structure, the system was examined using information from SCADA/ICS systems along with real and simulated datasets, complying with the NERC CIP, FERC orders, and cybersecurity guidelines by the U.S. Department of Energy. By having AI enhancements, the new framework performed better, was harder to break, showed lower latency, and could sense and respond to threats in no time such as data spoofing, command injection, and DDoS attacks. This research is relevant to smart grid cybersecurity as well as protective measures for SCADA and ICS systems, the security of the country’s energy infrastructure, and artificial intelligencebased solutions for identifying threats. In addition, the study introduces federated learning into live systems to ensure privacy in cyber defense and provides a suitable intelligent system to address immediate threats in national smart grids. Keywords: Smart Grids; Cybersecurity; Artificial Intelligence (Ai); Machine Learning (Ml); Scada/Ics Integration 1. Introduction 1.1. Smart Grid Adoption in the United States The United States has been at the forefront of smart grid adoption and government programs at both national and regional levels are promoting digital advances in the energy industry. To improve how the grid functions, operates, and recovers, both the DOE and other legal agencies have heavily funded grid modernization plans. According to the EIA, by the year 2023, 100 million smart meters will be deployed throughout the U.S., providing service to about 80% of electric customers. Due to these smart meters, data collection is possible in today’s grids, making it easy for utilities to monitor power use as it happens, react to power outages promptly, and introduce new dynamic pricing schemes. To improve automated fault detection, distributed energy applications, and management from a distance, utilities are turning to edge devices, intelligent substations, and distributed control systems as well as AMI. As these improvements increase the grid’s dependability and help save the environment, they introduce new problems and open the grid to risks from cyber threats 1.2. Cybersecurity Risks in the Evolving Grid As the grid starts to rely on data and interconnect more, cyberattacks also become more common and devastating. With more activities being performed on digital systems, hackers have more ways to harm the grid, making the entire system more vulnerable to large-scale disruption. Because many legacy SCADA systems do not have security built in, connecting them to the internet and IoT devices now introduces possibilities for criminals to seize control. Examples of threat World Journal of Advanced Research and Reviews, 2025, 27(01), 713-726 714 vectors are injecting malware, spoofing protocols, carrying out phishing attacks, using ransomware, and launching DDoS attacks. Because of these attacks, homes and businesses might lack power which could affect whole countries in severe ways. Attacks in 2015 on Ukraine’s power systems and ransomware attacks on the Colonial Pipeline in 2021 show the serious effects cyber threats have on the energy sector. As a result, members of the energy industry are now paying closer attention and looking for new solutions to protect smart grids. 1.3. Motivating AI-Augmented Defense The current approach to securing smart grids is important but proves insufficient as cyber threats continue to rise quickly. IDS systems that match signatures, ordinary firewalls, and repetitive security protocols do not match the quick and flexible requirements for stopping zero-day attacks and advanced methods by adversaries. In addition, the size of data produced by grid equipment increasingly means that detecting and responding to threats can’t be done manually. In such a situation, AI and ML provide valuable answers. They can independently scan a lot of data, spot anything unusual, spot uncommon attacks, and handle responses with limited involvement by people. LSTM networks have proven capable of finding time-related problems, while CNNs have been successful at locating manipulations of control signals. Federated learning works by training a model on many edge devices, without collecting the data centrally. Integrating AI into their systems allows utilities to move from reactive cybersecurity to a position where they automatically react to threats and constantly enhance their ability to detect them. With these systems, companies can monitor and control situations, following changes in regulations, so they are crucial for tomorrow’s energy system. Figure 1 Smart Grid Ecosystem and Vulnerable Entry Points 2. Literature Review 2.1. State of Cybersecurity in Smart Grids The emergence of smart grids represents a significant shift in the energy sector, offering efficiency, flexibility, and realtime management of resources. However, the integration of digital communication and control technologies into the grid infrastructure also introduces numerous cybersecurity challenges. As a cyber-physical system, the smart grid is vulnerable to threats targeting both its digital and physical components. Conventional security measures such as firewalls, encryption, and signature-based intrusion detection systems have been implemented, yet they often fall short in addressing advanced, adaptive, or unknown threats. These tools typically focus on known attack patterns and lack the ability to identify zero-day exploits or subtle anomalies in real time. As a result, smart grid security must evolve World Journal of Advanced Research and Reviews, 2025, 27(01), 713-726 715 toward intelligent, predictive, and autonomous systems capable of monitoring, detecting, and responding to complex cyber threats across all operational layers. 2.2. Notable Cyber Incidents in Energy Infrastructure Numerous cyber incidents in recent years have underscored the vulnerabilities present in critical energy infrastructure. (Ukraine Power Grid Attack, 2015), Ukraine's power grid was targeted in a coordinated cyberattack that resulted in a blackout affecting more than 230,000 citizens. The attackers used phishing emails, malware (Black Energy and KillDisk), and remote access tools to disrupt control systems. Similarly, the 2021 Colonial Pipeline ransomware attack, though not directly targeting the power grid, disrupted fuel distribution across the eastern United States, demonstrating the broader impact of cyberattacks on interconnected infrastructure. These events illustrate the urgent need for enhanced cybersecurity frameworks that can proactively detect, isolate, and mitigate threats in real-time. 2.3. Role and Limitations of Traditional Cybersecurity Approaches Traditional cybersecurity mechanisms in industrial control systems (ICS) and operational technology (OT) environments are largely reactive, relying on predefined rules and signature-based detection. While these systems offer baseline protection, they are ineffective against novel attacks, insider threats, or advanced persistent threats (APTs). Moreover, many legacy SCADA systems lack modern security features such as encryption, authentication, and access controls, making them easy targets for attackers. Perimeter-based defenses are insufficient when attackers exploit vulnerabilities within internal networks or leverage compromised devices to move laterally. As smart grids become more complex and interconnected, it is essential to adopt dynamic, intelligent security solutions that can adapt to emerging threats and provide real-time situational awareness. 2.4. Emergence of AI in Cybersecurity Artificial Intelligence (AI) and Machine Learning (ML) offer powerful tools to overcome the limitations of traditional security methods. By analyzing vast datasets and identifying patterns that indicate malicious behavior, AI systems can detect zero-day attacks and adapt to new threat models. Supervised learning methods like Support Vector Machines (SVM) and Random Forests, as well as unsupervised techniques like k-means clustering, have shown promise in cybersecurity applications. More advanced architectures, such as Long Short-Term Memory (LSTM) networks and Convolutional Neural Networks (CNNs), have been applied to intrusion detection, anomaly recognition, and behavioral analysis in smart grid environments. These models improve threat detection accuracy, reduce response time, and enable automation in high-volume, complex networks. 2.5. AI Applications in Smart Grid Cybersecurity Recent studies have explored the application of AI in smart grid cybersecurity with promising results. LSTM networks have demonstrated the ability to identify temporal anomalies in telemetry data, while CNNs have been used to classify control commands and detect abnormal operations. Federated learning—a decentralized approach—has enabled collaborative model training across distributed grid components without compromising data privacy. AI has also been integrated into SCADA systems to support predictive anomaly detection and automated threat containment. Although many of these technologies have shown success in simulations and testbeds, real-world deployment remains limited, emphasizing the need for further validation and infrastructure alignment. 2.6. Identified Research Gaps and Opportunities Despite progress in integrating AI into smart grid cybersecurity, several gaps remain. Most AI models have not been deployed in real SCADA or SOC environments, limiting their practical application. Furthermore, many models are trained on synthetic or narrow datasets, raising concerns about their robustness and generalizability. Ethical and regulatory aspects, such as compliance with data governance policies and transparency of AI decisions, are underexplored. Additionally, emerging threats like adversarial attacks on AI models require greater attention in smart grid contexts. Future research must focus on developing scalable, interpretable, and regulation-compliant AI frameworks that are resilient to both technical and organizational challenges within critical infrastructure environments. Many impactful cyber incidents affecting energy supply have made it clear that strong cybersecurity is essential for smart grids. For many observers, the 2015 attack on the Ukrainian electricity grid stands out the most. The incident was the first known cyber-attack to successfully hit a power grid. The attack was managed by a group of skilled cyber attackers, who also used Black Energy and KillDisk malware to take control of systems at the Ukrainian power companies. Thus, more than 230,000 residents suffered a power outage during the turbulent winter season. Its World Journal of Advanced Research and Reviews, 2025, 27(01), 713-726 716 complexity surprised experts; the attack used social engineering, spear phishing, malware and remote access tools to demonstrate the range of methods cybercriminals can exploit smart grid systems. (Colonial Pipeline, 2021), the Colonial Pipeline regulatory authorities were also targeted by the Darkside cybercriminal group in an attack. Because the attack hit IT systems instead of the crucial operational technology, there was still widespread alarm and fuel scarcity along the East Coast. Operations at the affected pipeline were ceased as soon as the incident was noticed, demonstrating how IT and OT systems in infrastructure are related. While this was not a deliberate attack on an energy grid, it did indicate the big problems that can hit important energy sectors due to cyberattacks. Such incidents prove that modern energy systems are at risk and that cyber-attacks have real and serious consequences. They indicate clearly that there is a real risk because these attacks happen everywhere. They can influence huge numbers of people, bring down a nation’s economy and threaten the public. As a result, companies need cybersecurity systems that are smart, automatic and predictive to identify security breaches as early as possible and act quickly. Table 1 Summary of Existing Research on AI for Smart Grid Cybersecurity Author(s) Year AI Technique Target Component Key Findings Limitations Geller et al. 2019 LSTM Neural Networks SCADA anomaly detection Detected temporal anomalies in grid signals with >95% accuracy Requires large, labeled datasets; sensitive to data drift Alipour et al. 2020 CNN + Autoencoder Smart meter data Identified spoofed consumption patterns with low false-positive rates High computation cost on embedded devices Yan and Qian 2017 SVM with Feature Selection AMI network traffic Improved detection of DoS attacks in wireless sensor networks Limited scalability to fullscale deployments Liu et al. 2021 Federated Learning (FL) Distributed control systems Preserved data privacy while achieving >90% detection accuracy Communication overhead and synchronization complexity Ozay et al. 2016 Random Forests, PCA Phasor Measurement Units Detected false data injection attacks in PMU streams Performance degraded with increasing noise levels Li et al. 2022 Hybrid LSTMCNN Substation protection system Real-time classification of command injection and firmware modification threats High training time and dependency on feature engineering Kim and Park 2020 Deep Reinforcement Learning Grid intrusion response Enabled automated decision-making for containment of cyberphysical attacks Requires robust simulation environments; not yet field-tested World Journal of Advanced Research and Reviews, 2025, 27(01), 713-726 717 Figure 2 Evolution of Cyber Defense Technologies in Smart Grids 3. Methodology This study adopts a multi-layered methodology that combines federated learning with deep learning models, specifically Long Short-Term Memory (LSTM) and Convolutional Neural Networks (CNN), to build a scalable and intelligent cybersecurity framework for smart grid environments. The methodology is divided into data preparation, model architecture design, system integration, and evaluation. 3.1. Data Collection and Preprocessing To evaluate the framework, both real-world and synthetic datasets were used. Real-world datasets were obtained from publicly available intrusion detection system (IDS) logs and smart grid telemetry sources, while synthetic datasets were generated to simulate various attack scenarios, including data spoofing, command injection, and DDoS attacks. Data preprocessing involved normalization, encoding of categorical features, and the creation of time-series sequences to train the LSTM networks. Feature selection was based on correlation analysis and domain relevance. 3.2. Federated Learning Architecture A federated learning setup was implemented to enable distributed model training across different grid components, such as substations, smart meters, and edge devices. Instead of centralizing raw data, each node trains a local model and sends only the model parameters to a central aggregator. This approach preserves data privacy while enabling collaborative learning across heterogeneous systems. The federated server synchronizes global model weights using a weighted average of local updates. TensorFlow Federated was used as the primary framework for implementation. 3.3. Deep Learning Model Design Two deep learning models were used. The LSTM model was configured to capture temporal dependencies in telemetry data. It included multiple memory cells with dropout layers to reduce overfitting and was trained using mean squared error (MSE) as the loss function. The CNN model was employed to classify control actions and detect spatial anomalies in grid traffic data. Both models were implemented using TensorFlow and Kera's libraries and trained using a combination of real-time and offline datasets. 3.4. System Integration and Deployment The framework was integrated into a simulated SCADA/ICS environment to assess real-time performance. The testbed included components such as Programmable Logic Controllers (PLCs), Human-Machine Interfaces (HMIs), and Remote Terminal Units (RTUs), all emulated using open-source ICS tools. The AI models were deployed at the edge level for World Journal of Advanced Research and Reviews, 2025, 27(01), 713-726 718 local detection and connected to a cloud-based analytics dashboard for central monitoring. The system architecture ensured minimal latency and allowed for real-time anomaly alerts and mitigation strategies. 3.5. Evaluation Metrics The performance of the proposed framework was evaluated based on multiple metrics, including detection accuracy, false positive rate, precision, recall, F1-score, and latency. Resilience was also tested under adversarial conditions using evasion and poisoning attacks. The framework's results were benchmarked against traditional IDS systems to highlight improvements in threat detection capabilities and response time. The evaluation also included stress-testing under varying network conditions to assess robustness and scalability. • To evaluate classification tasks, I use Precision, Recall and the F1-score. • AUC-ROC is measured for cases where the goal is binary or multi-class anomaly detection. • FPR and Detection Latency play a big role in implementing this technology where time matters. 3.6. Continuous Learning and Model Updating Smart grid cyber systems are always changing as fresh threats come up regularly. To keep running well, the system uses incremental learning and regularly retrains itself. If the accuracy of the model starts to drop, drift detection mechanisms call for its updates. Tools used by human analysts provide feedback to help enhance the accuracy of predictions, finetune models and modify the rule-based reconnaissance process. Figure 3 AI/ML Pipeline for Smart Grid Cyber Defense 3.7. Adversarial Robustness and Threat Modeling To effectively counter adversarial threats targeting AI models—such as evasion attacks (where malicious inputs are crafted to bypass detection), data poisoning (where training data is subtly corrupted to mislead the model), and model inversion (where attackers try to reconstruct sensitive input data from outputs)—a robust set of hardening strategies has been integrated into the machine learning pipeline. One of the primary defenses involves adversarial training, which enhances model resilience by including intentionally manipulated examples during the training process. Techniques World Journal of Advanced Research and Reviews, 2025, 27(01), 713-726 719 like Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) are used to generate these adversarial samples, allowing the models to learn how to recognize and resist deceptive patterns. In addition, gradient masking is employed to obscure the gradient information that attackers often exploit when crafting adversarial inputs, while feature smoothing ensures that small perturbations in input data do not result in disproportionately large changes in output predictions, thereby improving model stability. The architecture also incorporates ensemble learning, where the outputs of multiple independently trained models—each with varying architectures or training datasets—are aggregated to make final decisions. This diversity in model reasoning increases the system’s robustness by making it harder for adversarial inputs to universally deceive the system. Furthermore, to ensure continuous adaptability in realtime environments, each edge-deployed model is equipped with drift detection mechanisms, such as ADWIN (Adaptive Windowing) and Kolmogorov–Smirnov statistical tests, which monitor incoming data streams for shifts in distribution. When anomalies or drifts are detected, the system triggers automatic retraining to restore model accuracy and relevance. These combined defenses create a multilayered shield that preserves the integrity, reliability, and trustworthiness of AI-driven cybersecurity systems, even in the face of evolving, sophisticated adversarial techniques. Table 2 Machine Learning Models and Their Application to Smart Grid Cybersecurity Model Type Algorithm Used Target Application Advantages Limitations Deep Learning (DL) LSTM Time-series telemetry analysis Captures temporal dependencies; high accuracy Requires large datasets and computational power Deep Learning (DL) CNN ICS command stream classification Strong pattern recognition; robust to noise Less interpretable; needs tuning for sequential data Supervised ML Random Forest, SVM Smart meter and AMI traffic analysis Fast training; good for structured data Requires labeled datasets Unsupervised ML Autoencoder, Isolation Forest Anomaly detection in SCADA logs Works without labels; detects unknown attacks Higher false positives if not tuned properly Distributed ML Federated Learning Substation-level decentralized protection Preserves privacy; scalable Communication overhead; model convergence issues 4. System Design 4.1. Overview of Architecture Various advanced machine learning models are being used with this framework to help a multi-layered cybersecurity system detect anomalies and respond automatically to threats. The system mainly consists of some connected modules. The Data Ingestion Layer grabs data from smart meters, sensors, SCADA log reports and external threat intelligence, using safe APIs and message queues. Here, this data is handled by Preprocessing and Feature Engineering Layer, where it is straightened out, restructured, scaled and information on how it changes over time and statistics are derived, ensuring an optimal model can be used. Both known and new anomalies are identified across various data streams because the ML Inference Engine supports trained models like LSTM, CNNs and Isolation Forests. The Alert Generation and Correlation Engine checks the outputs from the engine and compares them to known attack signatures, using rules to prioritize the alerts. Threats identified by the system are shown on a Visualization and Analyst Dashboard to help SOC teams understand their severity, how they started and steps for addressing them. Analysts’ notes and what the system finds are used in a Feedback and Learning Loop to continuously update and train the AI, so it responds well to newer cyber-attacks. 4.2. SCADA/ICS Integration Industries rely on SCADA and ICS, so smooth integration is very important for any airborne platform. Modules for AI are put inside Docker or Kubernetes containers so they can be added alongside controls without much interruption. This device is compatible with modern and older equipment because it uses the Modbus, DNP3 and IEC 61850 protocols. The outcomes from running inference models are used to produce alerts. These alerts can either appear on human screens or set off actions via PLCs. World Journal of Advanced Research and Reviews, 2025, 27(01), 713-726 720 4.3. Cloud and Edge Deployment Options To address latency and bandwidth limitations, the system supports hybrid cloud-edge deployment: Low-latency anomaly detection happens at Edge Nodes placed at substations or AMI gateways. Cloud Backends are designed to perform threat intelligence analysis, train models over a long period and coordinate activities across the whole system. As a result, devices at the edge can act in almost real time while the bulk of learning and correlation happens in the scalable and strong cloud. Table 3 Functional Modules and Integration Aspects Module Functionality Integration Point Technology Stack / Tools Data Ingestion Layer Collects grid telemetry, ICS logs, meter data, threat feeds AMI, SCADA, IDS, external APIs Kafka, MQTT, OPC-UA, REST APIs Preprocessing Engine Cleans, transforms, and extracts features from data On-premises edge servers Pandas, NumPy, Scikitlearn, TensorFlow-Data ML Inference Engine Performs anomaly detection using trained AI models SCADA monitoring systems TensorFlow, PyTorch, ONNX Runtime Alert Correlation & Response Correlates outputs and initiates responses or alerts Security Operations Center (SOC) ELK Stack, Suricata, SIEM platforms Dashboard & Visualization Displays alerts, trends, root causes to analysts Utility control rooms Grafana, Kibana, custom web dashboards Feedback & Continuous Learning Updates model based on analyst input and retrained periodically Analyst terminal, cloud backend Active learning APIs, federated update protocols Table 4 Resource Consumption: Edge vs. Cloud Trade-offs Resource Metric Edge Node (e.g., Substation) Cloud Backend (Centralized) CPU Usage ~45–65% (Raspberry Pi 4 / Jetson Nano) ~20–40% (VM with GPU acceleration) Memory Footprint ~1.2–1.8 GB per model ~6–10 GB per analytics pipeline Latency (Inference) 200–500 ms 1–2 seconds (excluding upload delay) Network Load Low (only model updates sent) High (continuous telemetry streaming) Energy Consumption ~5–10 W ~100–150 W per instance Edge setups optimize for real-time local detection and privacy preservation but are hardware constrained. Cloud servers, while resource-rich and ideal for deep model training and coordination, suffer from upload delays and centralized risks. The hybrid system leverages both to balance real-time response with long-term learning. 5. Results and discussion 5.1. Experimental Setup To assess the AI system, we created simulated smart grid networks using many types of real data. Among them was the use of typical telemetry logs, generated by software, that simulated regular and unusual grid activities to help test how well detection tools work. In addition, tests using common ICS/SCADA attack scenarios—such as command injection and taking unapproved control—were performed to check the system’s resilience to real cyber-attacks. Other training and validation data sets from ICS-CERT advisories, CICIDS intrusion benchmarks and smart meter records were used in our work. Because of using both synthetic, historical and practical data, the evaluation of the system’s detection accuracy, strong-point and flexibility was very thorough. World Journal of Advanced Research and Reviews, 2025, 27(01), 713-726 721 In the virtual test, the software models were placed with made-up substations, working with realistic communication protocols (DNP3, Modbus) and considering expected delays. 5.2. Key Performance Metrics Realistic operating conditions were used to assess the system’s accuracy, dependability and strength with various key performance indicators. The measured proportion of rightly spotted attacks or anomalies showed the main performance indicator for the model. To reduce alert fatigue in SOCs, the team looked at the rate at which the system issued incorrect alerts during normal times using the False Positive Rate (FPR). Detection Latency reported the time from when a threat was located to when an alarm about it was produced, reflecting how quickly the system can respond. Lastly, we assessed the framework’s reliability with a System Resilience Score, demonstrating how well it handled partial data loss, communication lag or reduced system inputs found in live smart grid situations. Due to the data from these measures, the team was able to judge the operation and dependability of the system. The results show significant improvements over baseline (non-AI) detection systems: Table 5 Performance Metrics of AI Models in Smart Grid Cyber Defense Threat Type Model Accuracy (%) False Positive Rate (%) Detection Latency (ms) Notes Command Injection (ICS) LSTM 96.2 3.1 420 Detected sequence anomalies in control commands AMI Spoofing CNN + Autoencoder 94.8 4.0 380 Identified falsified energy usage patterns DDoS on Substation Random Forest 91.5 5.8 290 Detected high-volume traffic spikes False Data Injection Isolation Forest 92.3 6.5 510 Detected abnormal sensor readings with minimal training Ransomware Signature SVM with PCA 89.9 5.2 450 Recognized behavioral patterns of file access anomalies 5.3. Simulated Case Studies 5.3.1. Case Study 1: Command Injection Attack on a SCADA Substation An attack simulation took place where an actor injected wrong signals to cause circuit breakers to open and close. Over 96% of the time, the LSTM-based system sensed anomalies in timing and prompted an alarm before the final order was sent. 5.3.2. Case Study 2: AMI Meter Spoofing Scenario software was written to fake smart meter readings and reduce the known patterns of usage. Using the CNNautoencoder method, the system noticed unusual changes in spending over different periods and similar devices, suggesting that something suspicious may be going on. 5.3.3. Case Study 3: Distributed Denial-of-Service (DDoS) on Communication Gateway A burst of traffic at a high rate was simulated over the communication link at the substation. The system spotted atypical readings and movements and was able to separate the node at risk, showing that it worked well both for detection and reaction.