## 4 Case Study  
We built a 691 \(\times\) 10,000 matrix in the form of a CSV file to create our dataset. Each row represents a moment in time for the respective measurements, while each column indicates a measurement point in the grid. A sample of measurements for the full grid is considered one row of data. Mininet takes around 4 s to create one data point, or 45 min for a given network sample, or row of data. This creates a temporal constraint because our ML model requires 10,000 rows of data. We use SimComponent, as previously stated, to reduce the time spent obtaining network data. In comparison, SimComponent generates the data required for one data sample in roughly 0.80 s, which is substantially quicker than Mininet, allowing the completion of the necessary dataset to acquire the results for the CECD-AS method, as shown in Table 1.  
CBench [36], a tool for benchmarking Openflow controllers, is used to test the SDN architecture. We can calculate the maximum throughput, or how much data was sent from a source at any particular moment, using CBench. CBench emulates the \(N\) amount of OpenFlow switches set by the researchers and connects it to the controller. Then, it emulates traffic and calculates and records the throughput. In the cluster, we test each ONOS controller individually to establish the maximum throughput for 45 open vswitches (15 switches for each controller). We ran this test again for the single POX controller for all 45 open vswitches at once and documented the results. Figure 11 shows the results of our controller benchmarking test. The ONOS cluster had an average throughput of 533.121 flows/ms, whereas the POX controller had a flow rate of 50.267 flows/ms, which is more than a tenfold improvement. Our tests revealed that a distributed controller design not only removes a single point of failure but also improves network and resource management throughput. By spreading the network workload, the ONOS cluster can endure the rigors of the smart grid better than a single controller. For parameter attack in the lines of power grid used by State Estimator, each line is attacked to form classes for classification. In the system under study, we have 117 lines, which are transformed into 117 classes in the KNN algorithm. For identifying which line of the power grid is being attacked, the KNN algorithm is implemented. The dataset is split into training and testing. For the training dataset, each line is attacked with false data injection into its parameter. The classification accuracy of the presented KNN algorithm is illustrated in Figure 12. \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Attack Type**} & **Accuracy** & **Precision** & **Recall** & **F1-Score** \\  & \(\mu_{cv}\pm\sigma_{cv}\) & \(\mu_{cv}\pm\sigma_{cv}\) & \(\mu_{cv}\pm\sigma_{cv}\) & \(\mu_{cv}\pm\sigma_{cv}\) \\ \hline MITM & 92.48 \(\pm\) 00.20 & 91.65 \(\pm\) 00.29 & 86.41 \(\pm\) 00.28 & **88.91 \(\pm\) 00.24** \\ \hline FDI & 99.95 \(\pm\) 00.01 & 99.46 \(\pm\) 00.34 & 99.87 \(\pm\) 00.13 & **99.61 \(\pm\) 00.17** \\ \hline DoS & 99.88 \(\pm\) 00.07 & 99.75 \(\pm\) 00.09 & 99.80 \(\pm\) 00.16 & **99.78 \(\pm\) 00.08** \\ \hline FDI-DoS & 99.63 \(\pm\) 00.08 & 98.42 \(\pm\) 00.26 & 99.95 \(\pm\) 00.04 & **99.20 \(\pm\) 00.15** \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Performance results for FDI, DoS, and MITM attacks (FDI: False Data Injection attacks, DoS: Denial of Service attacks, MITM: Man In The Middle attacks). To validate the cyber threat detection framework, IEEE 118 bus system is selected as the power grid under study. The power grid is simulated such that every 4 s a set of measurements is sent to the cloud where data is stored and analyzed by SE and ML. Hence, the data in the cloud is updated every 4 s. The data from the smart grid layer and communication are combined in the cloud and then analyzed to detect cyber threats.