###### Abstract  
Communication networks in power systems are a major part of the smart grid paradigm. It enables and facilitates the automation of power grid operation as well as self-healing in contingencies. Such dependencies on communication networks, though, create a roam for cyber-threats. An adversary can launch an attack on the communication network, which in turn reflects on power grid operation. Attacks could be in the form of false data injection into system measurements, flooding the communication channels with unnecessary data, or intercepting messages. Using machine learning-based processing on data gathered from communication networks and the power grid is a promising solution for detecting cyber threats. In this paper, a co-simulation of cyber-security for cross-layer strategy is presented. The advantage of such a framework is the augmentation of valuable data that enhances the detection as well as identification of anomalies in the operation of the power grid. The framework is implemented on the IEEE 118-bus system. The system is constructed in Mininet to simulate a communication network and obtain data for analysis. A distributed three controller software-defined networking (SDN) framework is proposed that utilizes the Open Network Operating System (ONOS) cluster. According to the findings of our suggested architecture, it outperforms a single SDN controller framework by a factor of more than ten times the throughput. This provides for a higher flow of data throughout the network while decreasing congestion caused by a single controller's processing restrictions. Furthermore, our CECD-AS approach outperforms state-of-the-art physics and machine learning-based techniques in terms of attack classification. The performance of the framework is investigated under various types of communication attacks. c 2022 2022005 5 July 20222005 July 2022005  
actors exploiting diverse security weaknesses in the physical and cyber domains of the cyber-physical system is a more realistic scenario for cyber-attacks. Denial-of-Service (DoS), Distributed Denial-of-Service (DDoS), and Man-in-the-Middle (MITM), False Data Injection (FDI) attacks might all be launched. These types of attacks impact data from several layers of the grid's physical structure. As a result, an integrated approach for identifying numerous attacks launched from different tiers inside the SG will improve grid security. Machine Learning (ML) technology is presently being utilized to aid in the detection process or to acquire reliable findings through statistical data analysis. At various phases of the SE process, the work of the data-driven anomaly detection framework and the cross-layer viewpoint has progressed and been examined [2; 3; 4; 5; 6]. An integrated solution of a cyber-physical security framework based on a cross-layer approach that focuses on the detection of various cyber assaults is described in this study. The implementation is based on a real-world scenario. The power grid is modeled in Simulink and data from the grid is gathered every 4 s and delivered to the cloud for analysis. SimComponents [7] is used to simulate communication grid data, which is created and transferred to the cloud. In the analysis layer, SE and ML models are used to identify data threats. The SE exclusively uses measured data from the power grid, but the ML combines data from both the power and communication grids. In addition, we propose an Open Network Operating System (ONOS) [8] three-controller distributed Software Defined Networking (SDN) architecture for the communication layer, which we tested and compared to the performance of one of the first SDN controllers, POX [9], which comes as standard with the Mininet emulation tool. SDN is a network architecture technology that allows networks to be intelligently and centrally managed, or programmed, using software applications. As its public release in 2009, software-defined networking (SDN) research has seen tremendous advancements and breakthroughs.