Real-Time Testbed for Studying Cyberattacks and Defense in DER-integrated Smart Inverter Systems

Conference · Thu Jun 19 04:00:00 EDT 2025

OSTI ID:2569880

Maliha, Maisha ^[1]; Oluyomi, Ayanfe ^[2]; Booge, Mark ^[1]; Bhattacharjee, Shameek ^[1]; Braasch, Noah ^[1]; Gomez, Pablo ^[1]; Das, Sajal K ^[2]

---

1. Western Michigan University
2. Missouri University of Science and Technology

In this paper, we propose a Hardware-in-the-Loop (HIL) simulation testbed suitable for the implementation and testing of realistic cyberattacks on grid-tied smart inverter systems integrated with Distributed Energy Resources (DER) that use the Distributed Network Protocol-3 (DNP3) protocol for communications between grid components. Specifically, our testbed combines a Real-Time Digital Simulator (RTDS) NovaCor device, outfitted with GNETx2 network interface cards, a gridtied DER topology implemented via the RTDS software package RSCAD, and a custom virtual network that emulates a man in the middle attacker. The Man-in-the-Middle (MITM) attacker captures DNP3 traffic and falsifies telemetry data in DNP3 packets to trigger unwarranted commands from a DNP3 controller that exploit smart inverter grid support functions. We choose DNP3 and implement grid support functions according to the IEEE Std. 1547-2018 mandated for the interconnection and interoperability of DER power systems with associated power components. Furthermore, we develop a protocol payload agnostic attack detection framework that leverages the round-trip time (RTT) anomalies between DNP3 requests and responses and can detect the presence of attacks without having to analyze the payload’s contents, while balancing trade-offs between false alarm counts, missed detections, and time to detection. To facilitate further research, we publicly release benign and attack network traffic exchanged between various sensors, controllers, and actuators in our grid-tied inverter testbed.

• Research Organization: Western Michigan University
• Sponsoring Organization: USDOE Office of Cybersecurity, Energy Security, and Emergency Response (CESER); Factory Mutual (FM)
• DOE Contract Number: CR0000029; CR0000029
• OSTI ID: 2569880
• Report Number(s): DOE-WMU-00029-7
• Country of Publication: United States
• Language: English

Related Subjects

24 POWER TRANSMISSION AND DISTRIBUTION
32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATION
DER
DNP3
cybersecurity
smart inverter