###### Abstract
SDN provides improved utilization, resource efficiency, network service flexibility, and lower maintenance costs as compared to conventional networks [10]. To the best of our knowledge, our suggested SDN framework is the first of its kind proposed in the literature. ONOS is the most widely used open-source SDN controller for next-generation SDN and Network function virtualization (NFV) applications. ONOS allows for network configuration as well as real-time control, removing the requirement for routing and switching control protocols to be executed inside the network fabric. By leveraging an SDN network topology, we can move the routing intelligence of the network to the ONOS controller to allow for better management, response, and visibility against cyber attacks against our network. In a previous work [11], the authors have demonstrated that a distributed SDN framework may effectively and efficiently govern and assist in the protection of a smart grid. The authors were able to protect the smart grid from a denial of service attack by combining distributed SDN controller placement, intrusion detection systems (IDS), and state estimation. However, the framework uses a global SDN controller and a global security controller as the network and security masters, respectively, which introduce single points of failure. Furthermore, defense results against false data injection or man-in-the-middle (MiTM) attacks are not discussed. In another previous work [12; 13], researchers suggest a distributed SDN framework to address scalability and reliability in smart grid systems. The authors of this study assume controller communication by using the BGP protocol to link two OpenDaylight controllers, allowing the controllers to share the workload of the network. This study, however, does not address smart grid security or protect against cyberattacks. Furthermore, the authors do not discuss or consider controller failure resistance in their framework. In another previous work [4], The authors created the Ensemble CorrDetwith Adaptive Statistics (ECD-AS) technique to analyze measurement data and packet contents. ECD-AS is another data-driven approach for detecting FDI attacks that takes into account the changing status of the SG. This method's drawback is that it solely employs measurement data, limiting its capacity to identify cyberattacks focused on the SG's communication network layer. However, the work in this research will make use of the analysis layer, which may also take into account data from the communication network that powers the SG, notably packet inter-arrival intervals, transmission delay (TD), and packet count (PC). Consideration of this form of data would broaden the model of an FDI cyberattack as well as uncover models of other types of cyberattacks that would be undetected by present methodologies in the literature. Previous work [3; 14] demonstrated that ML may be utilized in the cyber domain to enhance bad data analysis by acting on the same data as the SE. This hybrid data-driven physics-model-based framework makes use of both temporal data through ML and the system's known topology through SE. However, this approach, like the other current research investigations, solely covers FDI attacks and relies on routine measurements of power systems. As a result, it overlooks the SG's cross-layer interdependence. The remainder of the paper is organized as follows. Background information on the major components of the framework is presented in Section 2. Section 3 contains data flow information about the framework, and the implementation necessary to make it work. In Section 4, we present a case study. Lastly, in Section 5, we conclude the paper. The contribution of this work towards the state-of-the-art is two folds:  
1. To the best of our knowledge, the first proposed three controllers distributed SDN architecture for the Smart Grid's communication layer. 2. Identification of cyber attacks against the power grid using a cross-layered framework.