[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-128172-en":3,"doc-seo-128172-105":30,"detail-sidebar-cat-0-en-105":92},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},128172,549768702563,"Sage","https://ap-avatar.wpscdn.com/avatar/8000c4aa63b76e948b?x-image-process=image/resize,m_fixed,w_180,h_180&k=1786536092046926083",8,"Research & Report","Cyber threat intelligence for smart grids using knowledge graphs, digital twins, and hybrid machine learning in SCADA networks","SCADA networks in smart grids connect switches to multiple Intelligent Electronic Devices based on protective relays, creating exposure to False-Data Injection Attacks, Remote-Tripping Command Injection, and System Reconfiguration Attacks. These attacks can trigger SLG faults, IED-relay failures, and circuit-breaker open issues, while existing CTI methods lack visualization of attack effects. A novel digital-twin and machine learning framework transforms attack-related data, predicts outcomes using models such as Extra-Trees, XGBoost, Random Forest, Bagging, and Logistic Regression, and builds a knowledge-graph-based directed representation for clearer attack visualization.","Zayed University  \nZU Scholars  \nAll Works  \n3-25-2025  \nCyber threat intelligence for smart grids using knowledge graphs, digital twins, and hybrid machine learning in SCADA networks  \nNabeel Al-Qirim Zayed University  \nMunir Majdalawieh Zayed University  \nAnoud Bani-hani Zayed University  \nHussam Al Hamadi University of Dubai  \nFollow this and additional works at: [https://zuscholars.zu.ac.ae/works](https://zuscholars.zu.ac.ae/works)  \n Part of the Computer Sciences Commons  \nRecommended Citation  \nAl-Qirim, Nabeel; Majdalawieh, Munir; Bani-hani, Anoud; and Al Hamadi, Hussam, \"Cyber threat intelligence for smart grids using knowledge graphs, digital twins, and hybrid machine learning in SCADA networks\" (2025) . All Works. 7359.  \n[https://zuscholars.zu.ac.ae/works/7359](https://zuscholars.zu.ac.ae/works/7359)  \nThis Article is brought to you for free and open access by ZU Scholars. It has been accepted for inclusion in All Works by an authorized administrator of ZU Scholars. For more information, please contact [scholars@zu.ac.ae](scholars@zu.ac.ae).  \nBig Data and Artificial Intelligence in Cyber Security and Forensics-Original Research Article  \nCyber threat intelligence for smart grids using knowledge graphs, digital twins, and hybrid machine learning in SCADA networks  \nInternational Journal of Engineering Business Management  \nVolume 17: 1–15 © The Author(s) 2025 Article reuse guidelines:  \n[sagepub.com/journals-permissions](sagepub.com/journals-permissions)[ ](sagepub.com/journals-permissions)[DOI: 10.1177/18479790251328183](DOI: 10.1177/18479790251328183)  \n[journals.sagepub.com/home/enb](journals.sagepub.com/home/enb)  \nNabeel Al-Qirim 1 􀀁, Munir Majdalawieh1, Anoud Bani-hani 1 and Hussam Al Hamadi2 􀀁  \nAbstract  \nIn the SCADA (Supervisory Control and Data Acquisition) network of a smart grid, the network switch is connected to multiple Intelligent Electronic Devices (IEDs) that are based on protective relays. False-Data Injection Attacks (FDIA), Remote-Tripping Command Injection (RTCI), and System Reconfiguration Attacks (SRA) are three types of cyber-attackson SCADA networks, resulting in single-line-to-ground (SLG) fault, IED-relay failure, and circuit-breaker open issues occur. The existing cyber threat intelligence (CTI) approaches of grids are unable to provide visualization of cyber-attacking grid effects. To understand the full effect of the attacks, there is a need for a knowledge-graph method-based digital-twin cyber-attack visualization approach in SCADA networks, which is missing in existing SCADA systems. This study presents a novel “Digital-twin and Machine Learning-based SCADA Cyber Threat Intelligence (DT-ML-SCADA-CTI)” approach, which utilizes an innovative algorithm to visualize and predict the effects of cyber-attacks, including FDIA, RTCI, and SRA, on SCADA systems. The process begins with data transformation to generate cyber-attack grid data, which is then analyzed for attack prediction using machine learning models such as Extra-Trees, XGBoost, Random Forest, Bootstrap Aggregating, and Logistic Regression. To further enhance the analysis, a directed-graph (DiGraph) algorithm is applied to create a knowledge-graph-based digital twin, allowing for a deeper understanding of how these cyber-attacks impact SCADA operations. The comparison with existing models demonstrates the superiority of the proposed approach, as it offers amore detailed and clearer digital-twin representation of cyber-attack effects. This enhanced visualization provides deeper insights into attack dynamics and significantly improves predictive accuracy, showcasing the effectiveness of the proposed method in understanding and mitigating cyber threats.  \nKeywords  \nSmart grid, knowledge graph, digital twin, cyber threat intelligence, cyber physical systems, cyber intelligence, protective relay, SCADA, directed graph, machine learning, power system  \nDate received: 25 September 2024; accepted: 1 March 2025  \nIntroduction  \nThe use of ","cbCaitlcsxXcmLcb","https://ap.wps.com/l/cbCaitlcsxXcmLcb","pdf",2315569,1,16,"English","en",105,"# Abstract\n# Introduction\n## Digital twins in Industry 4.0 and smart grids\n## Cyber-physical systems and CTI challenges","[{\"question\":\"What cyber-attacks are considered in the proposed SCADA cyber threat intelligence approach?\",\"answer\":\"The study focuses on False-Data Injection Attacks (FDIA), Remote-Tripping Command Injection (RTCI), and System Reconfiguration Attacks (SRA) targeting SCADA networks in smart grids.\"},{\"question\":\"How does the method generate visualization and prediction of attack effects?\",\"answer\":\"It transforms data to construct cyber-attack grid datasets, predicts attack outcomes with machine learning models, and then applies a directed-graph knowledge-graph algorithm to form a digital-twin representation of cyber-attack impacts.\"},{\"question\":\"Why are existing cyber threat intelligence approaches considered insufficient?\",\"answer\":\"Existing CTI methods for grids cannot provide visualization of cyber-attacking grid effects, limiting understanding of the full consequences of attacks on SCADA operations.\"}]","Cyber threat intelligence for smart grids using knowledge graphs, digital twins, and hybrid machine learning in SCADA networks | PDF",1785945259,40,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":87,"head_meta":89,"extra_data":91,"updated_unix":28},"cyber-threat-intelligence-for-smart-grids-using-knowledge-graphs-digital-twins-and-hybrid-machine-learning-in-scada-networks","",{"@graph":36,"@context":86},[37,54,69],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/cyber-threat-intelligence-for-smart-grids-using-knowledge-graphs-digital-twins-and-hybrid-machine-learning-in-scada-networks/128172/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":63,"encodingFormat":61,"isAccessibleForFree":64,"interactionStatistic":65},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-22","2026-08-05",true,{"@type":66,"interactionType":67,"userInteractionCount":20},"InteractionCounter",{"@type":68},"ViewAction",{"@type":70,"mainEntity":71},"FAQPage",[72,78,82],{"name":73,"@type":74,"acceptedAnswer":75},"What cyber-attacks are considered in the proposed SCADA cyber threat intelligence approach?","Question",{"text":76,"@type":77},"The study focuses on False-Data Injection Attacks (FDIA), Remote-Tripping Command Injection (RTCI), and System Reconfiguration Attacks (SRA) targeting SCADA networks in smart grids.","Answer",{"name":79,"@type":74,"acceptedAnswer":80},"How does the method generate visualization and prediction of attack effects?",{"text":81,"@type":77},"It transforms data to construct cyber-attack grid datasets, predicts attack outcomes with machine learning models, and then applies a directed-graph knowledge-graph algorithm to form a digital-twin representation of cyber-attack impacts.",{"name":83,"@type":74,"acceptedAnswer":84},"Why are existing cyber threat intelligence approaches considered insufficient?",{"text":85,"@type":77},"Existing CTI methods for grids cannot provide visualization of cyber-attacking grid effects, limiting understanding of the full consequences of attacks on SCADA operations.","https://schema.org",{"og:url":52,"og:type":88,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":90,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":93},[94,98,102,106,111,116,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":95,"show_sort_weight":96,"slug":97},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":99,"show_sort_weight":100,"slug":101},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":103,"show_sort_weight":104,"slug":105},"Exam",70,"exam",{"id":107,"doc_module":4,"doc_module_name":46,"category_name":108,"show_sort_weight":109,"slug":110},5,"Comic",60,"comic",{"id":112,"doc_module":4,"doc_module_name":46,"category_name":113,"show_sort_weight":114,"slug":115},6,"Technology",50,"technology",{"id":117,"doc_module":4,"doc_module_name":46,"category_name":118,"show_sort_weight":29,"slug":119},7,"Healthcare","healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":46,"category_name":137,"show_sort_weight":107,"slug":138},19,"General","general"]