AI-Powered Intrusion Detection for Programmable Logic Controllers in Smart Grid and Industrial Energy Networks: A Reproducible Docker-Based Simulation Platform

Abstract

Operational Technology (OT) networks in electrical grids, substations, and other energy-sector critical infrastructure are increasingly interconnected with corporate IT networks under Industry 4.0, exposing legacy control protocols to cybersecurity risks that were never considered in their original design. Commercial OT security platforms offer enterprise-grade monitoring but remain closed-source, costly, and inaccessible for reproducible research, while academic work tends to validate isolated algorithms without a complete, testable platform. This paper presents a fully containerized, Docker-based simulation of an enterprise/OT network -- modelled on the IT/OT segmentation typical of substation and industrial energy environments -- that generates its own labelled traffic, trains a Random Forest classifier on 22 flow-level features, and performs live detection through a Streamlit dashboard. The pipeline combines four deterministic threshold rules with a supervised machine-learning layer to detect a simulated two-stage attack (reconnaissance followed by data exfiltration). Five-fold cross-validation of the Random Forest model achieved 100\% $\pm$ 0.000 accuracy on the internally generated dataset, with complete separation between normal (0.000--0.015) and attack (0.950--1.000) probability scores. Feature-importance analysis identified cross-subnet traversal, flow duration, and TCP SYN count as the strongest discriminators of malicious activity in this synthetic setting. The platform is open, replicable by anyone with access to Docker, and is proposed as a low-cost research and training testbed for intrusion detection in energy-sector OT networks, with extension to real PLC protocol traffic and public benchmark validation planned as a second project phase hello.