Trabalho em anais de eventoOpen Access

Cyberattack Vectors in Photovoltaic Systems: Applying Artificial Intelligence for InternetConnected Inverter Monitoring

SANTOS, ELTON JOHN CARVALHO DOS; TRINDADE, ALESSANDRO BEZERRA; Cordeiro, Lucas Carvalho

2026 • 2026 IEEE Colombian Conference on Communications and Computing (COLCOM)

Resumo

Denial-of-service (DoS) attacks targeting Modbus/TCP-connected photovoltaic (PV) inverters can severely degrade active-power delivery, threatening local revenue and, at scale, grid stability. Existing signature-based intrusion detection tools such as Snort and Zeek were not architected for Modbus/TCP PV telemetry, while most machinelearning IDS for industrial control systems have been validated on generic network traffic rather than PV-specific flows – a gap this work addresses. The authors propose an ensemble combining Random Forest and Support Vector Machine classifiers with weighted voting to detect DoS traffic. The model was trained and validated on a proprietary dataset of 43,200 labeled instances derived from a virtualized 100 kW PV-inverter testbed (OpenEMS in Docker, attacks via Scapy), stratified into 70/15/15 splits. The public UNSW-NB15 dataset appears only as background context, not for training. On held-out test data (83% attacks), the ensemble achieved 97.3% accuracy, 98.2% recall, 6.9% FPR, 95.6% balanced accuracy, and MCC 0.90. Under an evasion scenario with randomized packet sizes and timing, accuracy fell to 94.1% and recall to 93.7%, versus 12.5%/10.2% for Snort and 45.2%/43.8% for Zeek – a 48.9-point gain over Zeek. The system preserved >97% accuracy under up to 10% packet loss, with 12.3 ms inference latency and 23% CPU overhead. Although targeting the 75 kW–5 MW minigeneration range, these results are limited to a single low-end virtualized inverter and DoS attacks exclusively, demonstrating feasibility on this controlled testbed and strongly motivating future validation on physical hardware and multi-inverter deployments.

Autoria