An Approach To Abstract Multi-Stage Cyberattack Data Generation For Ml-Based Ids In Smart Grids

Power grids are becoming more digitized resulting in new opportunities for the grid operation but also new challenges, such as new threats from the cyber-domain. To address these challenges, cybersecurity solutions are being considered in the form of preventive, detective, and reactive measures. Machine learning-based intrusion detection systems are used as part of detection efforts to detect and defend against cyberattacks. However, training and testing data are often not available or suitable for use in machine learning models for detecting multistage cyberattacks in smart grids. In this paper, we propose a method to generate synthetic data in the form using a graphbased approach for training machine learning models in smart grids. We use an abstract form of multi-stage cyberattacks defined via graph formulations and simulate the propagation behavior of attacks in the network. The results showed that machine learning models trained on synthetic data can accurately