Article’s

Project presents a Smart grid protection system with real-time cyber threat detection designed to enhance the cybersecurity and operational reliability of smart grid and industrial control systems. Traditional power grid systems face increasing cyber threats such as unauthorized access, denial-of-service attacks, malware infections, and protocol-based exploits, leading to disruptions and financial losses. To address these challenges, the proposed system integrates real-time system monitoring, network traffic analysis, machine learning-based anomaly detection, and industrial protocol inspection. It continuously monitors parameters such as CPU usage, memory utilization, network traffic, and running processes, detecting suspicious activities using rule-based methods and an Isolation Forest-based anomaly detection model. The system also inspects industrial communication protocols like Modbus and DNP3 to identify unauthorized access and abnormal commands. A file scanning module integrated with the Virus. Total API enhances malware detection. Upon identifying threats, the system automatically responds by blocking malicious IPs, terminating suspicious processes, and generating alerts. A real-time web-based dashboard provides continuous monitoring and visualization, along with email notifications to ensure quick response. The system is designed to be scalable, efficient, and cost-effective for modern smart grid environments. In addition, a custom spyware attack using a keylogger was created to test the system. The attack collects keystrokes, screenshots, audio, and system data, and tries to send it outside. The SGPS detects this activity in real time and automatically responds by sending alerts and stopping the process, showing its effectiveness against real-world cyber threats.