Training the grid to spot cyberattacks without seeing your data

Modern power grids depend on constant chatter. Smart meters, gateways, and control centres exchange data every second to balance demand, bill accurately, and keep electricity flowing. That connectivity, however, is also a vulnerability. Distributed denial-of-service (DDoS) attacks—malicious attempts to flood a server with excessive, fake traffic—can delay readings, disrupt operations, and at worst, trigger outages.

 

With 6G networks on the horizon, researchers at the Singapore University of Technology and Design (SUTD) anticipate a denser, faster, and more automated grid. As such, they explored how to detect DDoS attacks early and at scale without exposing people’s energy-use data in their paper, “Towards enhancing security for upcoming 6G-ready smart grids through federated learning and cloud solutions”.

 

Led by Professor Yeo Kiat Seng, the research team built and tested a prototype  intrusion-detection framework that trains models where the data live (on devices), coordinates learning in the cloud, and conceptually aligns with the ultra-low latency and high device density expected of future 6G networks.

 

Federated learning forms the crux of their solution: instead of sending raw meter data to a central server, each device trains a local model and shares only model updates. A cloud coordinator then aggregates the updates to improve a global model and redistributes them to devices, so that the whole fleet learns collaboratively while private data stays put. This combination of federated learning at the edge with cloud coordination shows how the use of design, artificial intelligence (AI), and technology could create a grid that is both smarter and more secure.

 

“Our work is an exploratory step towards understanding how federated learning and cloud technologies could help secure future smart grids as 6G environments emerge,” explained Prof Yeo, who added that their work is complementary to, and not a replacement of, existing measures.

 

To explore feasibility, the team built two proof-of-concept testbeds under controlled experimental conditions. In the first, Raspberry Pi devices stood in for smart meters, training local models and sending updates to a workstation that played the role of a small base station. In the second, they simulated meters in Amazon Web Services (AWS), using virtual elastic compute cloud (EC2) instances equipped with Greengrass for local training and AWS Lambda functions for coordination. Other AWS services such as IoT Core, S3, DynamoDB, and Step Functions were used to manage messaging, data storage, and orchestration within the simulated environment.

 

“It’s important to note that we did not use a live 6G network,” shared Prof Yeo. “Taken together, our two prototypes illustrated how federated learning at the edge can be supported by cloud coordination, and how projected 6G features—such as very low latency, high device density, and high throughput—could further enable fast and privacy-preserving updates across many devices in future smart grids.”

 

The researchers evaluated several models, including logistic regression, a feed-forward neural network, and a one-dimensional convolutional neural network (1D-CNN), on a widely used benchmark of DDoS traffic (CIC-DDoS2019). A residual-CNN, designed to learn deeper temporal patterns and avoid vanishing gradients, performed best on the device testbed, reaching about 97.9 percent accuracy with strong precision and recall.

 

Importantly, when the same approach was run in the cloud-based prototype under controlled experimental conditions, performance remained broadly consistent. Using permutation tests, the team found no statistically significant differences in average precision, recall, or accuracy between the local and cloud runs—results that are encouraging for future large-scale coordination.

 

Practical measurements were equally important. On Raspberry Pi devices, the team quantified memory and CPU usage, power draw, training time, and communication overhead across models and rounds of federated training. The residual-CNN delivered the strongest detection but consumed more resources, pointing to real-world trade-offs. Scaling studies from 4 to 64 simulated nodes showed faster convergence and better precision/recall as more devices participated, while also revealing the growing share of time devoted to communication. These results suggest that bandwidth and orchestration will become increasingly important as such systems scale.

 

While the results are promising, the team remains cautious. Their solution is a research-stage framework validated on benchmark datasets and prototypes, not a live utility deployment.

 

“Our research is at the proof-of-concept stage, so the immediate application lies in providing a framework and experimental insights showing how federated learning with cloud integration could potentially enhance intrusion detection in smart grids,” described Prof Yeo.

 

He highlights that adoption would require pilots with real grid data, integration with existing defences (from authentication to rate-limiting), and alignment with regulations. The team also sees room to compare model families, such as transformer-based architectures, and to incorporate semi-supervised techniques (for example, pseudo-labelling) to learn from the large volumes of unlabelled traffic common in operational networks.

 

“As 6G brings denser connectivity and ultra-low latency communication, cyberthreats will also evolve,” Prof Yeo noted. “We need defences that learn continuously from diverse, local data while ensuring sensitive grid information stays protected. That’s the promise of federated learning—only if we pair it with careful engineering and rigorous validation.”

 

For utilities, the near-term value is directional. The study maps how a privacy-preserving detection layer could sit alongside current intrusion-detection systems, what resources edge devices would need, and how cloud services might orchestrate training and updates. It also highlights early bottlenecks, such as power budgets, bandwidth, and synchronisation, that must be tackled before real-world rollout.

 

The SUTD team’s next steps include gathering datasets that pair network traffic with physical measurements (voltage, current), testing adaptive schemes that adjust models to threat levels and grid conditions, and exploring energy-efficient variants for resource-constrained devices.

 

“Together with utility partners, we hope to translate the prototypes into collaborative pilot studies that measure detection quality, latency, and operational impact in the field,” added Prof Yeo.

---

---