A Distributed Cybersecurity Monitoring Architecture for Smart Microgrids

Abstract

Smart microgrids rely on continuous communication among distributed generation units, energy storage systems, flexible loads, and advanced control systems. Consequently, any network anomaly can propagate into frequency instability, voltage deviation, power-allocation imbalance, or protection-system failure. Centralised monitoring approaches support unified governance but may lose critical evidence or miss real-time deadlines across heterogeneous nodes, rapidly changing operating modes, or intermittently connected upstream links. This paper develops a distributed cybersecurity monitoring architecture comprising edge monitoring agents, regional coordination nodes, and a global security-orchestration platform. Responsibilities are systematically organised through four functional layers: local observation, neighbourhood corroboration, global governance, and controlled response. Network behaviour is interpreted jointly with the electrical state, while topology association, auxiliary evidence channels, and graded interlocks collectively support threat detection, fault localisation, and containment. Edge agents retain high-frequency raw evidence and perform low-risk local checks. Regional nodes verify events against neighbouring communication and electrical relationships. The global platform governs rules, models, credentials, and high-impact actions without entering the fastest control loop. A published islanded-microgrid simulation demonstrates how an independent auxiliary network can reveal covert intrusions and support system recovery. The proposed architecture creates a continuous, auditable evidence chain and preserves monitoring capability even when portions of the communication infrastructure are degraded, thereby enhancing the overall resilience of smart microgrid operations against emerging cyber-physical threats.