Machine Learning for Cybersecurity in Power Grids

📋 Type MA thesis
⚡ Status open
👤 Primary supervisors Julian Oelhaf Mamdouh Muhammad (Computer Science 7)
👥 Co-supervisors Siming Bayer Andreas Maier
📄 Document ⬇ Thesis-Proposal-Understanding-CP-Events-in-the-IEC-61850.pdf

Abstract

This thesis investigates how machine learning can support cybersecurity in modern power grids by distinguishing physical faults from cyberattacks. Using multimodal data from digital substations, the work combines electrical measurements, communication data, protection behavior, and system-level information. The thesis focuses on interpretable machine-learning methods and physically motivated feature engineering to identify which signals genuinely separate faults from attacks, uncover misleading correlations and dataset shortcuts, and assess which data sources provide reliable information for cyber-physical security.

Experimental testbed used to acquire the cyber-physical dataset. Adapted from Cibin et al. [1], CC BY 4.0.

What you will work on

  • Understand and audit the cyber-physical power-grid dataset, including labels, timestamps, experimental runs, synchronization, and representative event timelines across the recorded modalities.
  • Analyze individual features and feature groups across electrical measurements, IEC 61850 communication, protection observations, and system-level metrics.
  • Develop physics- and protocol-informed features and investigate relationships between the different parts of the cyber-physical system.
  • Build a reproducible machine-learning pipeline and compare raw versus engineered features and individual versus combined data modalities under controlled evaluation across independent experimental runs.
  • Analyze model behavior, errors, and possible dataset shortcuts to determine what information genuinely distinguishes physical faults from cyberattacks.

Depending on the findings, follow-up experiments may investigate early event recognition, held-out scenarios, observation windows, or the contribution of individual modalities.

Requirements

Required:

  • Strong Python programming skills
  • Solid understanding of machine-learning fundamentals
  • Experience with scikit-learn and/or PyTorch
  • Ability to independently explore and debug an unfamiliar research dataset

Ability to independently translate scientific literature into reproducible experiments and make continuous progress between supervision meetings

Helpful but not required:

  • FAU’s Deep Learning lecture or comparable coursework
  • Courses in Machine Learning, Pattern Recognition, Signal Processing, Cybersecurity, or Computer Networks
  • Experience with scientific Python, Linux, Git, or HPC systems
  • Basic knowledge of electrical engineering, power systems, protection, or IEC 61850

This thesis is not intended as a first Python or first machine-learning project. Prior knowledge of power systems or IEC 61850 is not required and can be learned during the thesis. Strong programming, analytical, and machine-learning fundamentals are more important.

Thesis Setup and Expectations

  • Duration: approximately 6 months, full-time (~40 hours/week)
  • Start date: flexible, by arrangement
  • Location: FAU Erlangen-Nürnberg

Attendance at the weekly project meeting in Erlangen is expected. The meeting currently takes place on Mondays from 14:00 to 15:30. Students are expected to work independently between meetings and present concrete results, code, problems, and next steps. PRL thesis students additionally participate in the relevant colloquium and give an introduction and final presentation.

The project progresses at a research-oriented, full-time pace. Dataset familiarization, preprocessing, and first baseline experiments are early-stage milestones, not final thesis contributions.

Indicative Timeline

  • Month 1: literature review, dataset and code audit, label and timing analysis, representative event reconstruction, task definition, split rules, and initial data-processing pipeline
  • Month 2: feature analysis and engineering, finalized extraction pipeline, initial ML baselines, and first raw-versus-engineered and individual-versus-combined modality comparisons
  • Months 3–5: controlled experiments, feature and modality ablations, evaluation across runs and scenarios, error analysis, robustness studies, and targeted follow-up experiments
  • Month 6: final analysis, thesis completion, reproducibility checks, code and artifact handover, and final presentation

By the end of Month 2, a functioning end-to-end pipeline, engineered feature set, initial machine-learning baselines, and first controlled comparison results are expected. The remaining thesis period is intended for deeper scientific analysis and validation.

Supervision

The thesis is supervised jointly by Julian Oelhaf (Computer Science 5) and Mamdouh Muhammad (Computer Science 7).

Apply

Send one PDF to julian.oelhaf@fau.de with the subject:

Application | Master’s Thesis | Power Grid Cybersecurity | <Your Full Name>

Email body (max. 200 words):

  • Short motivation for this specific thesis topic
  • Your earliest possible start date
  • Confirmation that you can regularly attend the Monday 14:00–15:30 meeting in Erlangen
  • Relevant ML, cybersecurity, networking, signal-processing, or power-systems courses you have completed

Attach as one PDF:

  • CV
  • Current transcript of records
  • Link to GitHub/GitLab or one representative programming or ML project, if available
  • A short technical note (max. one page): Suppose a classifier obtains very high accuracy when distinguishing physical faults from cyberattacks in a cyber-physical power-grid dataset. Why would this result alone not be sufficient evidence that the model has learned the underlying difference between faults and attacks? Describe at least two possible dataset or evaluation shortcuts and explain how you would test for them.

Incomplete applications will not be considered. Shortlisted applicants may receive a small technical or data-analysis task before being invited to a supervision meeting.

References

[1] N. Cibin et al., Cyber-Physical Power System Dataset for Cyber Security of Digital Substations, IEEE Access, 2026. Paper

[2] F. Sechi, N. S. Noori, C. Sharma et al., Towards distinguishing cybersecurity attacks and safety faults in distributed energy resources-rich smart grids: a systematic literature review, International Journal of Information Security, vol. 25, art. 160, 2026. Paper