Improving Network-Based Security and Resilience of the Power Grid: Opportunities for Artificial Intelligence
Power systems are large scale cyber-physical critical infrastructure systems whose electrical reliability and resilience is made possible by numerous interrelated operation and control subsystems that span diverse timescales from subcycle protecton and control to multi-year long-term planning. Threats to power systems are multifold and include myraid sources ranging from weather, to accidental failures, to intentional adversaries. In defending the resilient operation of these systems against such threats, it is crucial to take a holistic resilience-oriented approach: operating through failure. Operating through failure is defined as continuing to sustain the critical functions of the system, to ensuringe the reliable delivery of power to consumers during a disturbance, specifically especially whenduring events that may cause or require the degradation of some systems or non-ideal operation. This includes both cyber-resilience, partially achieved though network segmentation, as well as physical operational reliability, achieved though engineering in planning and operations[1]. Here, we would like to expand upon a particular element of that type of resilience-preserving response of defense: network defense. In particular, since power system communication and control networks are a crucial part of the infrastructure that underpins the resilient monitoring and operation of power systems, we focus in this article on the segmentation of these networks, including the design and deployment of proper firewall rules that enforce who can talk to whom on a network. Firewalls are a crucial element of network defense in these power systems, used to segment informational and operational technology networks, ensuring that only authorized users can remotely access/operate systems. Firewalls are configured with rules to block unwanted traffic, and there may be thousands of rules in a firewall. This type of defense is often referred to as perimeter defense because a firewall traditionally functions like a gatekeeper that decides what traffic to allow. However, recent years have seen a revolution in artificial intelligence (AI) technology, with systems transforming from passive, prompt-driven assistants to agentic AI, which provide capabilities as autonomous systems that can formulate plans, make decisions, and execute actions to achieve a goal. The electric power industry is now at a crucial inflection point, where it must address how these ever-evolving agentic AI capabilities and supporting infrastructures can potentially transform its resilience and defense capabilities. The cyber-physical power system defense ecosystem is a key area of interest, where a crucial element for the safe deployment of these technologies involves carefully assessing and evaluating their limitations, vulnerabilities, and risks. In this article, we explore the question: “How can machine learning help us with network defense?” We consider how network segmentation plays a role, and we offer possibilities for how these technologies can come together to enable more cyber-resilient power system operations.