Summary:
This paper presents a model for assessing the risk level of power grids under manipulation of demand via Internet of Things (MaDIoT) attacks. The model uses a multilayer framework that starts by assessing the compromise probability of each device from known vulnerabilities gathered through open-source intelligence (OSINT). The next step estimates the probability of a given compromised power at each load node by generating reference marginal probability density functions (PDFs) for two extreme scenarios (best-case and worst-case) with Monte Carlo simulations and comparing the node marginal PDF derived from the device probabilities with these reference PDFs. Finally, the grid risk is estimated by categorizing the joint grid PDF obtained from PowerFactory simulations of MaDIoT attacks with different node scenarios on two Institute of Electrical and Electronics Engineers (IEEE) transmission grids (IEEE9 and IEEE39). For this categorization, K-Means++, density-based spatial clustering of applications with noise (DBSCAN), and Gaussian mixture models were compared to derive thresholds that define interpretable risk categories. In the IEEE39 grid, Gaussian mixture models gave the most conservative risk levels and the lowest variability of levels within the worst-case attack configurations, and they depended less on the random seed than K-Means++.
Keywords: clustering; cybersecurity; machine learning; manipulation of demand via Internet of Things (IoT); power grids; risk analysis
JCR-JIF Impact Factor and WoS quartile: 2,900 - Q2 (2025)
DOI reference:
https://doi.org/10.3390/app162110967
Published on paper: November 2026.
Published on-line: November 2026.
Citation:
F. Bagheri-Gisour Marandyn, N. Rodríguez Pérez, M. Castro, L. Sigrist, G. López, "Probabilistic Risk Assessment in Power Grids Facing MaDIoT Attacks: A Multilayer Approach", Applied Sciences, Vol. 16, nº. 21, pp. 10967, November 2026. [Online: November 2026] doi: 10.3390/app162110967
Download this paper