Graph-based Impact Analysis of Cyber-Attacks on Behind-the-Meter Infrastructure

TL;DR

This work addresses the risk of cyber-attacks on behind-the-meter (BTM) infrastructure by constructing a graph-based cyber-physical energy system (CPES) model aligned with SGAM and validated via SHACL. The approach combines RDF-based knowledge graphs with SPARQL-driven augmentation to automatically extend the cyber infrastructure for scenario analysis, and uses pandapower for power-flow simulations. A case study on a SimBench-based semi-urban grid demonstrates how worst-case HEMS-based attacks can alter transformer loading without inducing voltage violations, illustrating the framework's feasibility and robustness. The proposed methodology offers a reusable, validated platform for cross-domain exchange and resilience analysis in CPES, enabling more comprehensive risk assessments and future co-simulation integrations.

Abstract

Behind-the-Meter assets are getting more interconnected to realise new applications like flexible tariffs. Cyber-attacks on the resulting control infrastructure may impact a large number of devices, which can result in severe impact on the power system. To analyse the possible impact of such attacks we developed a graph model of the cyber-physical energy system, representing interdependencies between the control infrastructure and the power system. This model is than used for an impact analysis of cyber-attacks with different attack vectors.

Figures (6)

• Figure 1: Visualisation of the Smart Grid Architecture Model showing the three-dimensional structure of the modelsgam2012.
• Figure 2: Simplified visualisation of the KG used in this work, consisting of a HEMS solution.
• Figure 3: The workflow starting from a PandaPower model showing the different steps, including the augmentation step, impact analysis, and export.
• Figure 4: Load difference of transformers in secondary substations for different attack scenarios in MW in the high load case.
• Figure 5: Load difference of transformers in secondary substations for different attack scenarios in MW in the low load case.