Privacy-Preserving Federated Cybersecurity Analytics for Smart-Grid SCADA: Maintaining Controllability and Observability Under Coordinated Attacks

Ensuring resilient controllability and observability in SCADA-based smart grids under coordinated cyberattacks remains a critical and unresolved challenge in modern cyber-physical power systems. This paper investigates the impact of coordinated cyberattacks on the stability and monitoring capabilities of SCADA-based smart-grid systems within a controlled cyber-physical environment. An active cyber-physical testbed representing a multi-bus power system was created to analyze how attacks targeting communication channels affect controllability and observability. Several attack scenarios were implemented, including remote access attacks via Secure Shell (SSH), Modbus/TCP flooding, and ICMP-based attacks, to monitor their impact on control actions, communication reliability, and system responsiveness. To address these vulnerabilities, a SCADA-based cybersecurity monitoring system was implemented within the controlled testbed environment. The system analyzes SCADA operational logs from smart grid devices while packet-level network traffic is captured and examined using monitoring tools such as Wireshark. A central monitoring layer coordinates system-wide attack detection and response. System resilience was evaluated using controllability and observability matrix rank analysis, together with dynamic stability metrics during attack conditions. Experimental and simulation results show that coordinated cyberattacks significantly degrade system performance, with the average delay rising from 12 ms to 210 ms, the packet loss rate increasing to 15.5%, and the command execution error rate reaching 40%. Furthermore, the ranks of the controllability and observability matrices dropped from 4 to 2, indicating a critical partial loss of the system’s control and monitoring capabilities. In this work, the federated-learning-based component is explored as a distributed, privacy-preserving cybersecurity monitoring framework for anomaly detection and observability enhancement using SCADA-derived datasets, rather than as a fully integrated real-time SCADA operational control mechanism. At the same time, the attack’s impact on electrical properties remained limited to less than 2%.