# Building Cyber-Resilient Smart Grids with Digital Twins and Data Spaces
## 2 Digital Twins and Data Spaces
### Data Spaces
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Component** & **Instances** & **Description** \\ \hline Substation & 30 & Key facilities for voltage transformation using transformers. \\ PowerTransformer & 8 & Devices that transfer electrical energy between voltage levels. \\ EnergyConsumer & 41 & Loads or consumers of electricity, such as residential or commercial customers. \\ ACLineSegment & 80 & Transmission lines that carry high-voltage electricity over distances. \\ Breaker & 26 & Circuit breakers that interrupt current flow after fault detection. \\ Disconnector & 40 & Switches for isolating parts of the network for maintenance or safety. \\ BusbarSection & 36 & Used within substations to distribute power and manage connections. \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Overview of electrical network components in Kropa’s smart grid. defences or use targeted phishing schemes to gain entry into the operational technology systems. Once they breach the perimeter, they could establish backdoors or alter the configuration of essential components, which might trigger a chain reaction of instability across the grid. The consequences of such breaches are dire, ranging from blackouts to physical damage, economic losses due to interrupted services, and significant safety risks for both the public and workers. In Figure 4, we present a NIST attack tree that outlines the sequential phases of a sophisticated cyber attack targeting the smart grid infrastructure. This visual representation captures the methodical approach taken by attackers, from initial intelligence gathering to the final destabilization of the grid. Attack Scenario. The attack scenario unfolds as a calculated and stealthy operation aimed at undermining the integrity of the smart grid infrastructure. It begins with the meticulous gathering of open-source intelligence, where attackers compile detailed information about the grid's layout and the personnel who operate it. This intelligence forms the foundation for a year-phishing campaign, tailored to deceive and exploit employees with access to critical control systems. Once the phishing attack succeeds, the intruders establish a backdoor, granting them clandestine access to the network. This unauthorized entry point is the precursor to a series of insidious actions, culminating in the manipulation of the substation's control settings. The attackers' ultimate goal is to induce grid instability, triggering a domino effect of power disruptions and system failures. ### SIEM in the Case Study

In light of the presented attack scenario, our architectural framework is designed with a strong emphasis on advanced monitoring capabilities to safeguard the infrastructure against cyber threats. Central to this design is the deployment of OpenSearch, which serves as the backbone for real-time data analysis and operational oversight of the smart grid. Figure 4: Attack tree on Kropa’s infrastructure. The configuration change phase, a critical juncture in the attack scenario, is addressed with OpenSearch's ability to closely monitor and visualize operational parameters. This is achieved through a dynamic dashboard, built using Graphana, that reflects real-time data, enabling the detection of unauthorized configuration changes. The system is configured to recognize deviations from standard operational parameters, ensuring that any abnormal activity is immediately flagged. Within the scope of our research, we have developed a dashboard, illustrated in Figure 5, that displays real-time telemetry data from electrical substations. The dashboard is engineered to parse and render time-series data, capturing a range of electrical parameters that are critical to the operational integrity of power distribution systems. The data include precise timestamps (coordinated universal time--UTC), substation identifiers, electrical loads in megawatts (MW), voltage levels in kilovolts (kV), the system frequency in hertz (Hz), the ambient temperature in degrees Celsius (\({}^{\circ}\)C), and the operational status of each substation.