# Advancements and Research Trends in Microgrids Cybersecurity
## 4 Software Defined Networking  
Software-Defined Networking (SDN) technology is an approach to network management that enables dynamic, resource-efficient, and programmable network configuration in order to improve network performance and monitoring. SDN centralizes the network intelligence in one network component by decoupling the forwarding process of network packets (data plane) from routing process and control actions (control plane). SDN is a useful solution to improve the performance, safety, and security of different types of networks, including smart grid control systems. OpenFlow is the most popular standard/protocol to exchange messages between control and data planes in SDN [22]. A comprehensive survey of SDN-based smart grid communication is presented in Reference [23]. Applications include Substation Automation, Advanced Metering Infrastructures, Phasor Measurement Units, and also microgrids. Many papers focus on the benefit of SDN in isolating different traffic types/applications, prioritizing traffic, assuring resilience and fast failure recovery, and for the implementation of virtual network slices [24]. SDN also has interesting applications for the security of Industrial Control Systems (ICS), especially for incident response. It allows increasing the resiliency of the control system, thanks to the possibility to dynamically re-configure the network after the detection of a fault or of a compromised device, allowing it to operate even in degraded conditions. This is particularly useful for control networks within critical infrastructures, which require extremely high availability. Reference [25] discusses how SDN and Network Function Virtualization (NFV) technologies can help design automatic incident-response mechanisms for ICS and also describes a prototype to show the feasibility in a scenario that uses Programmable Logic Controllers (PLC) managing a classical tank-filling control system. Reference [26] studies the applicability of emerging technologies in the area of IP networks,including SDN, NFV, and next generation firewalls, to secure ICS. Reference [27] proposes an attack detection and localization algorithm and designs an intervention strategy in the networked robot control field. A software-defined security approach to secure field zones in ICS is shown in Reference [28]: it consists of a hybrid anomaly detection module that inspects anomaly behaviors in network communications and physical process states. It proposes a multi-level security response module that allows isolating any compromised zone. Microgrids could significantly benefit from self-healing network management, which includes but is not limited to [29]:  
* quick reset and reconfiguration of switches in order to isolate suspicious devices in the microgrid;
* establishment of application-specific filtering operations in the switches located close to attack sources; and
* on-demand path establishment for control commands to shrink attacker's operation time window. SDN allows verifying the entire communication network concerning security policies (e.g., access control) and network situations (e.g., loop-freedom and congestion-freedom). SDN allows also directly implementing a Network Intrusion Detection System (NIDS) within the SDN controller, even if such implementation may introduce a latency time that could be incompatible with the allowed latency in a microgrid environment [30]. The application of the SDN paradigm in microgrids may comprehend both security and control applications, as shown in Figure 1.  
Focusing on security applications, the SDN paradigm has been applied in different scenarios, to address attacks that target different communication layers. Reference [31] proposes an SDN architecture able to switch between wireless and power line communication to keep proper control within a direct current microgrid under a Denial of Service (DoS) attack. Reference [31] proposes an architecture that exploits SDN control plane message exchanges over the power bus, allowing the reconfiguration of the data plane connections.