An Explainable Cyber Range-to-MATLAB Co-Simulation Framework for Attack-Chain and Power-Service Impact Analysis in Electric Power Networks

Complex cyberattacks on electric power networks traverse communication links, control objects and power-service processes, making it difficult to explain how network evidence propagates to operational impact. This paper proposes an explainable cyber range-to-MATLAB co-simulation framework that couples traffic-oriented security emulation with power service simulation. The cyber range generates security events, traffic records, alarms and asset topology evidence, while MATLAB models calculate distribution network states, line power flows, switching states, energy-storage PCS states and service-impact indicators. A unified clock, event-mapping function, asset topology and evidence graph connect cyber events with business disturbances and observable power outputs. Mathematical descriptions are developed for event sets, service-state vectors, coupling functions, attack intensity, service-impact score, synchronization error, evidence completeness and metric improvement. Validation focuses on distribution network and energy storage scenarios. At the mapped switching disturbance at t = 180 s, 23 of 33 nodes are de-energized, and 2.235 MW (60.16% of feeder load) is unsupplied. Five repeated trials with plus or minus 3% load perturbations give a mean load loss of 2.243 plus or minus 0.008 MW. Integrated defensive retesting reduces attack intensity from 0.60 to 0.08, alarm latency from 12.4 s to 2.8 s, and recovery time from 240 s to 60 s. The framework, therefore, links cyber-range evidence to direct, auditable power-service quantities for attack-chain interpretation and defensive assessment.