Mohamed Massaoudi

The proliferation of Internet of Things (IoT) devices has significantly expanded the attack surface for cyber threats, making effective intrusion detection systems (IDS) critical for network security. Traditional anomaly detection methods often struggle with high-dimensional network traffic data and evolving attack patterns. This paper presents a novel approach for cyber attack detection using Maximum Entropy Inverse Reinforcement Learning (MaxEnt IRL). The proposed method learns reward functions from normal network traffic patterns, enabling the identification of anomalous behaviors that deviate from expected normal operations. By leveraging the maximum entropy principle, the approach captures the underlying distribution of normal traffic states without requiring labeled attack samples during training. The study evaluates the performance with multiple attack types, including Distributed Denial of Service (DDoS), Address Resolution Protocol (ARP) poisoning, and Message Queue Telemetry Transport (MQTT) based attacks. Comprehensive experiments demonstrate that the proposed method achieves 91.18% accuracy, outperforming traditional machine learning approaches, deep learning methods, and other RL attack detection techniques. The results highlight the potential of MaxEnt IRL for robust and adaptive cyber attack detection in IoT environments. All the related codes and datasets publicly available at: https://github.com/Mmassaoudi-cell/maxent-irl-iot-ids.

The cyber-physical integration of power grids creates vulnerabilities to intrusion attacks. However, the existing neural network–based intrusion detection frameworks exhibit limited robustness against malicious threats. Furthermore, these frameworks struggle to effectively manage the pronounced class imbalance inherent in cybersecurity datasets. In response to these challenges, this paper presents a novel feature-adaptive asymmetric dynamic reweighting ensemble graph neural network (FADEG) for network intrusion detection systems in power grids. Our methodology introduces several novel contributions: (1) adaptive graph construction techniques that provide stronger connectivity for underrepresented classes, (2) asymmetric model capacity allocation that dedicates more representational power to challenging classifications, and (3) dynamic loss weighting strategies that evolve during the training process. The proposed framework incorporates an ensemble of diverse GNN models with varying architectures. This ensemble significantly improves the detection of normal network traffic while maintaining high accuracy for attack identification. Experimental results demonstrate that our approach achieves more balanced per-class performance compared to traditional models, with a 15-20% improvement in minority class detection accuracy. Synthetic minority oversampling technique (SMOTE) oversampling, specialized interaction features, and non-linear transformations were implemented to further enhance model robustness. The ensemble's voting mechanism provides additional resilience against misclassification. This makes the approach particularly valuable for real-world intrusion detection systems that must maintain high detection rates across all traffic types

Critical infrastructure systems such as the electric grid are increasingly cyber-physical, where communication and control are tightly intertwined with the physics-based processes of power flow. To ensure safe and resilient operation of these cyber-physical systems, a variety of sensors and analyses are required for monitoring and detection of abnormal or malicious behavior to achieve full cyber-physical situational awareness (CPSA). A diverse set of sensors are needed across interconnected systems of systems to achieve CPSA that collect different types of data at different time-scales, volume, and levels of sensitivity. To share this collected data with different analysis platforms, whether intrusion detection systems or state estimation algorithms, secure data exchange is essential. Designing secure data exchange across interconnected systems of systems (SoS) can be challenging without considering unique characteristics of the underlying cyber and physical processes. For example, in the electric power grid, it is important to consider the types of communication protocols, frequency of communications, and types of control schemes alongside the physics-based processes of power flow and types of measurements such as voltage, frequency, and current. In prior work, these important considerations were explored for heterogenous sensors, networks, and data types and several secure data exchange approaches were presented. In this paper, we build upon that research and provide design principles and experimental results for secure and resilient data exchange across distributed sensors and analytics in decentralized, cyber-physical energy systems.

Transient instability poses a critical challenge to the reliable operation of modern power systems (PSs), often leading to large-scale blackouts. Despite the success of data-driven transient stability assessment (TSA), its practical implementation remains limited by challenges in processing high-speed real-time data streams and preserving data privacy. To address these limitations, this article develops a novel federated adaptive random forest (FedARF) method that integrates federated learning with the adaptive random forest (ARF) model. The proposed decentralized framework incorporates concept drift adaptation mechanisms to accommodate the stochastic and dynamic characteristics of modern PSs. FedARF facilitates distributed knowledge aggregation learned from various heterogeneous local data sensors (clients) to predict and evaluate the TSA status with minimal communication overhead. Comprehensive experiments on the New England 39-Bus system, the IEEE 68-Bus system, and the large-scale ACTIVIgs 25k-Bus system demonstrate the efficiency of the proposed method with an overall accuracy of 99.65%. Compared to traditional centralized forecasting methods, and state-of-the-art models, the proposed approach not only maintains high-prediction accuracy but also enhances data privacy preservation while substantially reducing communication bandwidth requirements.

Microgrid systems have gained significant prominence as compelling platforms for investigating and validating advanced power system operations due to their inherent flexibility and resilience. However, such systems are susceptible to complex cybersecurity risks that require proactive and robust defense mechanisms. Failure to address these vulnerabilities can severely undermine the coordination and power-sharing mechanisms among distributed generators (DGs). This paper introduces a cyber-physical emulation of an existing microgrid at the University of St. Thomas with its overlaid synthetic cyber network to evaluate its vulnerabilities and strengthen its security. Unlike previous testbeds that focus primarily on single-layer analysis or simplified attack models, our framework uniquely integrates real-world microgrid specifications with comprehensive cyber network emulation, enabling the first systematic evaluation of complex multi-stage attacks on operational microgrids using industry-standard protocols and structured adversarial techniques. Our results reveal that correlation analysis identified critical attack relationships. Implementing these focused security measures shows a reduction in attack success rates by 64% and improved system recovery time following disruptions, demonstrating the framework’s effectiveness for enhancing microgrid resilience. Different threat scenarios, guided by the MITRE ATT&CK framework, are implemented to systematically assess the system’s susceptibility to cyberattacks. Additionally, the Distributed Network Protocol 3 (DNP3) is leveraged to collect data in the form of DNP3 objects, enabling effective monitoring and control within this threat simulation. Our findings demonstrate the enhanced resilience of the microgrid when subjected to various cyber threats. Furthermore, it highlights how the proposed methodology can be scaled to safeguard larger power systems.

The increasing penetration of renewable energy sources (RESs) has transformed power system operations. However, balancing supply and demand is more challenging due to the inherent variability of RESs. This paper presents an efficient framework that integrates demand flexibility, RESs, and energy storage in distribution systems to enhance distribution system performance. The study implements a detailed time-series power flow analysis to investigate the impact of distributed energy resources (DERs) on system performance over a 24-hour period. The simulations incorporate a modified IEEE 123-bus network with two PV systems, flexible loads, and a 300 kW/1200 kWh battery. Additionally, the IEEE 8500-node distribution feeder integrates higher-rated PV, wind generators, and a 500 kW/2000 kWh battery to evaluate grid performance under diverse operational conditions. The battery storage system provides essential grid support through strategic charging during high PV generation and discharging during peak demand periods. The simulation results demonstrate robust voltage regulation and effective demand response throughout the feeder despite varying generation and load conditions. The flexible loads effectively respond to system conditions, varying between 23 to 82 kVA. This study demonstrates the viability of coordinated DER operations and their impact on modern distribution networks.