NetSim Cyber: Model and Simulate Power Grid Cyber Attacks
Last updated: Oct 2026
Modern electric power grids are cyber-physical systems, in which power equipment, communication networks and control software operate together. This convergence improves efficiency and automation, but it also introduces cybersecurity risks. NetSim Cyber lets you study these risks safely in a laboratory. It sits between grid devices or simulators, and changes the live protocol traffic between them (C37.118, IEC 61850, Modbus, DNP3, IEC-104). With these changes, you can model attacks such as false data injection and replay, measure their effect, and test your defences.
Worked examples: four attacks and a packet filter on live C37.118 and Modbus traffic
The threat is real and escalating
Power grids are now prime targets, and they receive more attacks than other critical infrastructures. These three incidents show the threat.
2015 · Ukraine
Ukrainian Power Grid Attack
This was the first confirmed cyber-induced blackout. Attackers operated substations remotely and cut power to over 200,000 consumers.
2022 · Ukraine
Industroyer2
Malware hard-coded for IEC-104 tried to physically destroy substations during missile strikes. It was a clear cyber-kinetic attack.
2023-24 · USA
Volt Typhoon
State-sponsored actors covertly infiltrated U.S. power grid networks for months. They used legitimate admin tools to prepare for future disruption.
Why NetSim Cyber
To improve CPPS security, you need a realistic testbed that can replicate power-system behavior under malicious conditions.
The problem
Hardware testbed limitations
High cost and procurement complexity
Limited scalability: multi-substation scenarios are hard to replicate
Safety risks in malicious attack scenarios
Inflexible configurations: each change requires physical rewiring
The approach
Software digital twin
A complete CPPS testbed combines a power-system simulator (generators, power
electronics, transmission, distribution) with a network simulator that models the
communication network and its cyber behavior.
NetSim Cyber provides the network and attack-emulation layer.
You reconfigure it in software, with no physical rewiring.
With a power-system simulator, it forms a digital twin of the full CPPS.
See NetSim Cyber in action
This walkthrough shows how to simulate and analyse cyber attacks on power grids. It covers ICS/OT security workflows end to end.
▶
NetSim Cyber: simulate and analyse cyber attacks on power grids | ICS/OT
security
System architecture
NetSim Cyber connects protocol source simulators to destination analysis tools through a common Core. The Core intercepts live traffic, applies protocol-aware attacks and recalculates checksums. It then delivers the wire-valid modified packets to the destination.
NetSim Cyber Core: end-to-end protocol workflow
System 1 · Source
Protocol simulators
Synchrophasor PMU, GOOSE/SV publisher, Modbus slave, DNP3 outstation or STTP
publisher generate original traffic on a controlled LAN.
Simulator reference.
System 2 · Core
NetSim Cyber Core
The Core intercepts traffic, applies protocol-aware attacks and recalculates checksums. On the wire, the modified packets look the same as legitimate packets.
System 3 · Destination
Analysis tools
PDC/WAMS, IED/relay, SCADA/HMI or utility control receive and validate the modified
traffic.
NetSim Cyber: network simulation and cyber attack layer
Three ways to run it
NetSim Cyber does not model the power system. It manipulates the protocol traffic between
the two ends, and you choose what to connect at each end.
Option 1 · Full grid behaviour
Connect a real-time simulator
Wire NetSim Cyber to RTDS, OPAL-RT or Typhoon HIL to see how an attack plays out on
a full power-system model. The simulator drives the grid dynamics, and NetSim Cyber attacks the traffic in between.
Option 2 · Real devices under test
Connect physical equipment
Put real protection relays and IEDs from vendors such as SEL or Siemens on the wire,
then test how they respond to manipulated protocol traffic.
Option 3 · No external hardware
Use the built-in simulators
If no simulator or field device is available, NetSim Cyber generates the protocol traffic itself. You can then develop and test attacks standalone. See the
protocol simulators.
In all three setups, your team can rehearse attacks. It can then check whether your intrusion detection and monitoring systems catch them, before it matters on the live grid.
Protocol deep dive
NetSim Cyber rewrites individual protocol fields. It does not use generic packet fuzzing. Each protocol has attack modules that parse structure, field semantics and checksum requirements.
Synchrophasor
IEEE C37.118
IEEE C37.118 is the standard for synchrophasor data transmission in Wide Area Monitoring Systems (WAMS). Utilities use it for real-time grid monitoring, state estimation and protection. NetSim Cyber supports the 2005 (v1), 2011 (v2) and 2024 profiles, including the 64-phasor, 4-frequency-channel model.
NetSim Cyber sits between the PMU and the PDC, and intercepts and modifies synchrophasor traffic
Attacks
Phasor magnitude inc/decrement
Pulse faults and ramp drift injection
Random jitter on phasor values
Manual phasor/freq/ROCOF override
FDI on frequency and ROCOF
SOC timestamp shift
Replay capture and playback
Technical details
Frame sync 0xAA, CRC-CCITT pre-mutation
Version-aware: 2005 (v1), 2011 (v2), 2024
Polar and rectangular phasors, int/float
64 phasors, 4 freq channels (2024 model)
Physics-driven freq, voltage, load-flow angle
SOC/FRACSEC fields fully modifiable
IEC 61850
GOOSE / Sampled Values
Generic Object-Oriented Substation Events (GOOSE) and Sampled Values (SV) carry substation
communication in IEC 61850 networks. Attacks on these protocols can trigger false breaker trips, corrupt protection relay logic and disrupt substation automation.
Attacks
stNum override
sqNum override
timeAllowedToLive override
Simulation flag toggle
Dataset tampering (bool/float/uint)
SV smpCnt and smpSynch override
SV payload: Va/Vb/Vc/Vn, Ia-In
Technical details
BER tag parsing, allData field discovery
Handles stNum, sqNum, TAL simulation
SV ASDU: smpCnt, smpSynch, seqData
80 or 256 samp/period, sine and constant
Breaker trip and process-bus integrity test
Simulation flag distinguishes test vs live traffic
Industrial control
Modbus TCP
Modbus TCP is a common protocol in industrial control systems and SCADA environments. Register tampering and
coil manipulation can cause incorrect actuator commands and corrupt historian data without
raising alarms.
Attacks
Register increment/decrement
Register ramp drift and jitter
Fixed-value false data injection
Manual register override by address
Coil/discrete bit: ON / OFF / FLIP
Technical details
MBAP header parse and response rebuild
Targets FC01, FC02, FC03, FC04
Slave simulator serves FC01-FC06, FC15, FC16
Fields: func code, byte count, registers
Master polls all 4 types, logs all responses
IEEE 1815
DNP3
DNP3 is the standard protocol for utility-to-substation communication in North America. Unauthorized
control commands and replay attacks can trigger remote switching operations and corrupt SCADA
historian records.
Attacks
FDI: analog/binary inputs, counters
Replay via interceptor path
Unauthorized direct/select-operate
Link-status recon and integrity polling
Time skew writes
Enable/disable unsolicited responses
Cold/warm restart, DoS flooding
Technical details
Start 0x05 0x64, header and block CRC
Transport seg, obj groups, CROB
Point DB: binary, analog, counter I/O
Interceptor: outstation-master traffic
Class poll, replay, ctrl paths via GUI
Supports both solicited and unsolicited modes
Telecontrol
IEC 60870-5-104
IEC 60870-5-104 is a telecontrol protocol for communication between control centers and substations over TCP/IP networks. Electric power transmission and distribution systems use it widely for supervisory control and data acquisition. IEC-104 supports telemetry, telecontrol, event reporting and status monitoring between a master station and a controlled station.
Attacks
Telemetry value modification
Status indication manipulation
Replay of valid messages
Delay of telecontrol messages
Packet drop
Time-tag manipulation
Technical details
IEC 60870-5-101 app layer over TCP/IP
Port TCP 2404, master to controlled station
Single/double-point information, measured values
Commands, integrated totals, time-tagged events
Use case: transmission/distribution SCADA, telecontrol security
Integration with power-system simulators
NetSim Cyber interfaces with real-time power-system simulators and electrical platforms.
Feature highlights
NetSim Cyber does these things, which hardware testbeds and generic security tools do not.
Focus
Post-exploitation
NetSim Cyber evaluates the grid impact after a breach, not how the breach occurred. It does no penetration testing and deploys no malware. It runs only in a controlled lab environment.
Method
Protocol-aware mutation
NetSim Cyber rewrites individual fields in Synchrophasor, GOOSE, Modbus, DNP3 and IEC-104 traffic. It does not use generic packet fuzzing.
Fidelity
Wire-valid packets
NetSim Cyber recalculates CRCs and transport checksums after each change. On the wire, the modified packets look the same as legitimate packets.
Form factor
Software attack layer
NetSim Cyber runs in software as the network and attack layer between your endpoints. You reconfigure it in software, without the cost or rewiring of a hardware testbed.
Integrations
Power-system tools
NetSim Cyber interfaces directly with OPAL-RT, RTDS, HYPERSIM, PSCAD, MATLAB/Simulink, Typhoon HIL, OpenPMU and openPDC.
Outcome
Proactive resilience
Validate detection and countermeasures before attacks occur on live infrastructure.
Who is NetSim Cyber for
NetSim Cyber is for teams that work on the cyber-physical security of electric power systems.
Utilities and grid operators
Power-system utilities and national grid operators evaluate the attack impact on production infrastructure.
SCADA and substation engineers
Protection, SCADA and substation automation engineers validate relay logic and process-bus integrity.
Cybersecurity teams
Security teams validate protocol-aware detection and countermeasures on power-system traffic.
CPPS researchers
Cyber-physical lab integrators and researchers build software digital twins of power systems.
Defence and critical infrastructure
Defence and critical-infrastructure agencies prepare for cyber-kinetic attack scenarios.
Academic institutions
Universities and training organisations teach CPPS security with reproducible experiments.
Independent validation
Publications that used NetSim
These peer-reviewed papers on power-system cybersecurity used NetSim to build and validate their models.
