# Advancements and Research Trends in Microgrids Cybersecurity
## 8 Conclusions  
In the present work, the application of some of the most promising technology for Industrial Control System to the Smart Microgrid environment has been discussed. These technologies present different maturity levels: while some are addressed by standards, such as in the IEC 62351, others require much more effort for the effective implementation in electrical power systems. SDN decouples the data and control plane and allows controlling an entire data network, thus assuring the action of access control, as well as of congestion avoidance schemes. Having a centralized control also allows implementing a Network Intrusion Detection System (NIDS) directly in the SDN controller and improving microgrid resiliency against cyber attacks and faults. The drawback of using SDN stands in the possible delay introduced by these actions, which could be incompatible with some actions required in an industrial environment. If most NIDS implementation are already commercial tools, Host IDS (HIDS) may represent an improvement, particularly if they act in real-time. Real-time HIDS may use information locally available at the host, such as CPU and memory, system calls, loaded modules and libraries, user behavior, and information  
Figure 2: Control levels of the electrical grid. about interfaces, to detect anomalies. The main problem is the time necessary for these algorithms to run and the requested computational power, possibly not available in the industrial terminals where HIDS should act. One of the more interesting research activities concerning the security of smart microgrids and, more generally, of ICS is represented by schemes able to detect abnormal physical behaviors based on measures extracted by the industrial process. Anomaly can be defined as something that deviates from what is standard, normal, or expected. In the context of physics-based anomaly detection, it is an undesired physical working condition of the process, a deviation of the process from a known working condition defined as normal, or as an impossible observation of the state of the process because of an incoherence of the measurements. This definition includes working conditions caused by either faults or malicious manmissions of control devices, actuators, and sensors. In the field of industrial processes, and especially in power systems, typical anomaly detection strategies are based on the dynamic state estimation. Even if efficient, this approach requires the knowledge of the exact behavior of the system. Machine Learning (ML) approaches could be useful to face up this problem. In the field of cyber-physical systems anomaly detection, it is quite common not to have a dataset containing examples of bad physical behavior during a cyber attack. So, it is mandatory to apply algorithms that can \"learn\" a behavior considered to be normal and classify new examples. The last promising research field discussed in the paper is represented by resilient control strategies. The control of electrical grids is essential for the service continuity. Both in islanded and grid-connected modes, taking control of the electrical grid can cause great damages and also affect the stability of the whole grid. Resilience is essential in this field. Further research is necessary to develop commercial products to be used in the field, but results from simulations and prototypes are really promising. Conceptualization, G.B.G., P.G., and M.M. ; methodology, G.B.G. and M.M. ; formal analysis, G.B.G. and M.M. ; investigation, G.B.G. ; resources, P.G. and M.M. ; data curation, G.B.G. ; writing--original draft preparation, G.B.G. ; writing--review and editing, M.M. ; visualization, G.B.G. ; supervision, M.M. ; project administration, P.G. ; funding acquisition, P.G. All authors have read and agreed to the published version of the manuscript. This research received no external funding. Not applicable. The authors declare no conflict of interest. The following abbreviations are used in this manuscript: