Cyber threat intelligence for smart grids using knowledge graphs, digital twins, and hybrid machine learning in SCADA networks

Aug 5, 2026

Upload by Sage

SCADA networks in smart grids connect switches to multiple Intelligent Electronic Devices based on protective relays, creating exposure to False-Data Injection Attacks, Remote-Tripping Command Injection, and System Reconfiguration Attacks. These attacks can trigger SLG faults, IED-relay failures, and circuit-breaker open issues, while existing CTI methods lack visualization of attack effects. A novel digital-twin and machine learning framework transforms attack-related data, predicts outcomes using models such as Extra-Trees, XGBoost, Random Forest, Bagging, and Logistic Regression, and builds a knowledge-graph-based directed representation for clearer attack visualization.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages16

Reading Time40 min

AccessFree to download

Abstract

Introduction

Digital twins in Industry 4.0 and smart grids

Cyber-physical systems and CTI challenges

Zayed University ZU Scholars All Works 3-25-2025 Cyber threat intelligence for smart grids using knowledge graphs, digital twins, and hybrid machine learning in SCADA networks Nabeel Al-Qirim Zayed University Munir Majdalawieh Zayed University Anoud Bani-hani Zayed University Hussam Al Hamadi University of Dubai Follow this and additional works at: [https://zuscholars.zu.ac.ae/works](https://zuscholars.zu.ac.ae/works) Part of the Computer Sciences Commons Recommended Citation Al-Qirim, Nabeel; Majdalawieh, Munir; Bani-hani, Anoud; and Al Hamadi, Hussam, "Cyber threat intelligence for smart grids using knowledge graphs, digital twins, and hybrid machine learning in SCADA networks" (2025) . All Works. 7359. [https://zuscholars.zu.ac.ae/works/7359](https://zuscholars.zu.ac.ae/works/7359) This Article is brought to you for free and open access by ZU Scholars. It has been accepted for inclusion in All Works by an authorized administrator of ZU Scholars. For more information, please contact [scholars@zu.ac.ae](scholars@zu.ac.ae). Big Data and Artiﬁcial Intelligence in Cyber Security and Forensics-Original Research Article Cyber threat intelligence for smart grids using knowledge graphs, digital twins, and hybrid machine learning in SCADA networks International Journal of Engineering Business Management Volume 17: 1–15 © The Author(s) 2025 Article reuse guidelines: [sagepub.com/journals-permissions](sagepub.com/journals-permissions)[ ](sagepub.com/journals-permissions)[DOI: 10.1177/18479790251328183](DOI: 10.1177/18479790251328183) [journals.sagepub.com/home/enb](journals.sagepub.com/home/enb) Nabeel Al-Qirim 1 􀀁, Munir Majdalawieh1, Anoud Bani-hani 1 and Hussam Al Hamadi2 􀀁 Abstract In the SCADA (Supervisory Control and Data Acquisition) network of a smart grid, the network switch is connected to multiple Intelligent Electronic Devices (IEDs) that are based on protective relays. False-Data Injection Attacks (FDIA), Remote-Tripping Command Injection (RTCI), and System Reconﬁguration Attacks (SRA) are three types of cyber-attackson SCADA networks, resulting in single-line-to-ground (SLG) fault, IED-relay failure, and circuit-breaker open issues occur. The existing cyber threat intelligence (CTI) approaches of grids are unable to provide visualization of cyber-attacking grid effects. To understand the full effect of the attacks, there is a need for a knowledge-graph method-based digital-twin cyber-attack visualization approach in SCADA networks, which is missing in existing SCADA systems. This study presents a novel “Digital-twin and Machine Learning-based SCADA Cyber Threat Intelligence (DT-ML-SCADA-CTI)” approach, which utilizes an innovative algorithm to visualize and predict the effects of cyber-attacks, including FDIA, RTCI, and SRA, on SCADA systems. The process begins with data transformation to generate cyber-attack grid data, which is then analyzed for attack prediction using machine learning models such as Extra-Trees, XGBoost, Random Forest, Bootstrap Aggregating, and Logistic Regression. To further enhance the analysis, a directed-graph (DiGraph) algorithm is applied to create a knowledge-graph-based digital twin, allowing for a deeper understanding of how these cyber-attacks impact SCADA operations. The comparison with existing models demonstrates the superiority of the proposed approach, as it offers amore detailed and clearer digital-twin representation of cyber-attack effects. This enhanced visualization provides deeper insights into attack dynamics and signiﬁcantly improves predictive accuracy, showcasing the effectiveness of the proposed method in understanding and mitigating cyber threats. Keywords Smart grid, knowledge graph, digital twin, cyber threat intelligence, cyber physical systems, cyber intelligence, protective relay, SCADA, directed graph, machine learning, power system Date received: 25 September 2024; accepted: 1 March 2025 Introduction The use of

FAQs

What cyber-attacks are considered in the proposed SCADA cyber threat intelligence approach?

The study focuses on False-Data Injection Attacks (FDIA), Remote-Tripping Command Injection (RTCI), and System Reconfiguration Attacks (SRA) targeting SCADA networks in smart grids.

How does the method generate visualization and prediction of attack effects?

It transforms data to construct cyber-attack grid datasets, predicts attack outcomes with machine learning models, and then applies a directed-graph knowledge-graph algorithm to form a digital-twin representation of cyber-attack impacts.

Why are existing cyber threat intelligence approaches considered insufficient?

Existing CTI methods for grids cannot provide visualization of cyber-attacking grid effects, limiting understanding of the full consequences of attacks on SCADA operations.

Aug 5, 2026

Upload by Sage