Fabien Enzo Daho Sechi

• Sechi, Fabien; Noori, Nadia; Charu, Sharma; Sharma, Pawan; Aidoo, Isaac Kweku & Gonzalez-Longatt, Francisco [Show all 7 contributors for this article] (2026). Towards distinguishing cybersecurity attacks and safety faults in distributed energy resources-rich smart grids: a systematic literature review. International Journal of Information Security. ISSN 1615-5262. 25. doi: 10.1007/s10207-026-01308-z. Full text in Research Archive Show summary

  This study presents a Systematic Literature Review (SLR) of methods and challenges related to distinguishing cybersecurity attacks and safety faults in Distributed Energy Resources (DER)-rich smart grids. The increasing integration of DERs has improved grid flexibility and sustainability, but has also introduced greater operational complexity and expanded the attack surface of smart grid infrastructures. In such environments, cyber-attacks and safety faults may produce similar anomalies, making accurate distinction a critical requirement for resilient and secure grid operation. This review examines the literature on anomaly detection and event classification in DER-rich smart grids towards distinguishing these anomalies and events, with a particular focus on approaches that could support the differentiation of malicious and non-malicious events. It analyzes the main categories of data used in the literature, including sensor data, smart meter data, network traffic, phasor measurements, and weather-related information. It also reviews machine learning and artificial intelligence techniques, including supervised, unsupervised, and deep learning approaches, and discusses their applicability, strengths, and limitations within different contexts. Furthermore, the review synthesizes evaluation practices, operational application domains, and key open challenges, including limited dataset realism, data quality issues, explainability, scalability, and model generalization. Existing testbeds are highlighted as essential for reproducing realistic grid conditions and validating approaches; however, in their current state, no testbed framework is directly applicable to distinguishing cybersecurity attacks from operational safety faults in an informed manner. Importantly, only 6 of the 25 included primary studies explicitly attempt to distinguish cyber-attacks from physical safety faults within a single evaluation setting. The review is therefore explicitly positioned as a combined systematic mapping and gap analysis: rather than demonstrating a mature solution space, it documents how sparsely the central distinction problem is addressed, characterizes the few existing attempts in depth, and derives a research agenda from this gap. Overall, the review identifies major research gaps and outlines directions for developing more safe and secure solutions for DER-rich smart grids.

• Sechi, Fabien & Noori, Nadia Saad (2025). Conceptual framework for testbed design: specific to cybersecurity and operational safety anomalies in DER-rich Smart Grid. In Nasreddine, Belkacem Abdelkader (Eds.), 2025 IEEE International Conference on Systems, Man, and Cybernetics (SMC). IEEE (Institute of Electrical and Electronics Engineers). ISSN 9798331533588. p. 1371–1378. doi: 10.1109/smc58881.2025.11343373. Full text in Research Archive Show summary

  In recent years, the digitalisation of power grid systems and the integration of Distributed Energy Resources (DERs) into smart grids (SGs) have increased the complexity of the electrical power ecosystem in Europe, thereby making it more vulnerable to cyberattacks. Despite the development of AI-based anomaly detection systems aimed at improving monitoring and attack identification, a significant limitation persists: such systems often fail to distinguish between cybersecurity attacks and operational safety faults or anomalies. Consequently, there is a critical need to develop more effective methods for detecting and categorising different operational conditions and failures within the power grid. However, the development of such complex systems is not feasible without adequate data and testbeds capable of simulating real-world baseline operational conditions before deployment in production environments.This paper presents a conceptual Cyber-Physical System (CPS) testbed tailored for Europe’s DER-rich smart grids. The testbed integrates human operators, Artificial Intelligence (AI), safety protocols, and robust security measures. It connects a simulated SG electrical energy distribution network based on the CIGRE standard, a Human-Machine Interface (HMI) Supervisory Control and Data Acquisition (SCADA) control room (CR), and a Security Operations Center (SOC) at the Institute for Energy Technology. The objective is to simulate real-world conditions for electrical energy distribution and control systems under complex critical scenarios caused by operational failures and cyber vulnerabilities.First, we evaluated existing machine learning(ML)/AI-based anomaly detection methods and associated datasets in terms of accuracy and explainability in CPS environments. This evaluation revealed the absence of datasets that capture both safety-related and security-related anomalous operational conditions. Second, we conducted a systematic literature review of existing testbeds to extract key requirements necessary to simulate disruptions resulting from operational failures and cyber vulnerabilities. Identified gaps included inadequate simulation of real-world conditions, insufficient modeling of human-AI interaction, and the absence of structured root cause analysis and anomaly categorization methods. We validated the proposed conceptual framework through expert consultation with specialists in cybersecurity and power systems engineering.The proposed conceptual testbed design was made to meet the minimum requirements identified in this research work, to help create a realistic simulation of cyber vulnerabilities and operational failures, facilitating the development of anomaly detection systems that distinguish between cyber threats and operational faults. We detail the architecture, defined scenarios, and implementation, and propose a blueprint and evaluation framework using performance metrics such as realism, scalability, flexibility, and security robustness. The resulting conceptual framework demonstrates the testbed’s potential to meet baseline requirements for cybersecurity and operational safety assessment in SGs. This work contributes to advancing the security and reliability of critical energy infrastructure, with global implications.

• Oruma, Samson Ogheneovo; Ayele, Yonas Zewdu; Sechi, Fabien & Rødsethol, Hanne Kristine (2023). Security Aspects of Social Robots in Public Spaces: A Systematic Mapping Study. Sensors. 23(19), p. 1–29. doi: 10.3390/s23198056. Full text in Research Archive Show summary

  Background: As social robots increasingly integrate into public spaces, comprehending their security implications becomes paramount. This study is conducted amidst the growing use of social robots in public spaces (SRPS), emphasising the necessity for tailored security standards for these unique robotic systems. Methods: In this systematic mapping study (SMS), we meticulously review and analyse existing literature from the Web of Science database, following guidelines by Petersen et al. We employ a structured approach to categorise and synthesise literature on SRPS security aspects, including physical safety, data privacy, cybersecurity, and legal/ethical considerations. Results: Our analysis reveals a significant gap in existing safety standards, originally designed for industrial robots, that need to be revised for SRPS. We propose a thematic framework consolidating essential security guidelines for SRPS, substantiated by evidence from a considerable percentage of the primary studies analysed. Conclusions: The study underscores the urgent need for comprehensive, bespoke security standards and frameworks for SRPS. These standards ensure that SRPS operate securely and ethically, respecting individual rights and public safety, while fostering seamless integration into diverse human-centric environments. This work is poised to enhance public trust and acceptance of these robots, offering significant value to developers, policymakers, and the general public.

• Sechi, Fabien (2023). Critical Convergence for enhanced safety: A Literature Review on Integrated Cybersecurity Strategies for Information Technology and Operational Technology Systems within Critical Infrastructure. In Brito, Mario P.; Aven, Terje; Baraldi, Piero; Cepin, Marko & Zio, Enrico (Ed.), ESREL 2023 - Proceedings of the 33rd European Safety and Reliability Conference : The Future of Safety in the Reconnected World, 3 – 7 September 2023, University of Southampton, United Kingdom. Research Publishing Services. ISSN 9789811880711. p. 3414–3421. doi: 10.3850/978-981-18-8071-1_P539-cd. Full text in Research Archive Show summary

  Cyberattacks targeting critical infrastructure highlight that both information technology systems (IT) and industrial control systems (ICS) are vulnerable to cyber security events and that cyberattacks targeting IT can have effects on ICS and vice versa. These events indicate a need for an improved understanding of the similarities and differences between IT security and ICS/operational technology systems (OT) security. This paper explores the technological aspects of tools, methods, and approaches used to secure IT and OT systems, and the crisis decision-making processes related to management, strategy, organization, and governance. The methodology of this exploratory study is a literature methods approach using PRISMA methods that gather academic articles from the "Web Of Science" database. We discuss fifteen papers on IT and OT systems similarities in terms of security needs, and in terms of significant differences between the two that must be considered. The paper explores the trade-offs between applying IT-focused cyber security tools and approaches to ICS and OT. Results are disseminated in terms of two main research questions that are RQA) What are the similarities and differences between IT and OT security? And RQB), how can these disparities be effectively addressed to protect these systems from cyberattacks? We conclude by outlining future research directions aimed at expanding on the findings of research questions A and B.

• Sechi, Fabien & Ayele, Yonas Zewdu (2022). Security Implications of Social Robots in Public Space - A Systematic Literature Review. In Leva, Maria Chiara; Patelli, Edoardo; Podofillini, Luca & Wilson, Simon (Ed.), Proceedings of the 32nd European Safety and Reliability Conference (ESREL 2022). Research Publishing Services. ISSN 9789811851834. p. 2308–2315. doi: 10.3850/978-981-18-5183-4_S10-06-274-cd. Full text in Research Archive
• Sechi, Fabien; Gran, Bjørn Axel; Jørgensen, Per-Arne & Kilyukh, Oleh (2022). Better Security Assessment Communication: Combining ISO 27002 Controls with UML Sequence Diagrams. In Bae, Doo-Hwan (Eds.), Proceedings, 3rd International Workshop on Engineering and Cybersecurity of Critical Systems (ENCYCRIS 2022). Association for Computing Machinery (ACM). ISSN 9781665462259. doi: 10.1145/3524489.3527304. Full text in Research Archive
• Chockalingam, Sabarathinam; Esnoul, Coralie; Simensen, John & Sechi, Fabien (2021). Serious Games for Cyber Security: Elicitation and Analysis of End-User Preferences and Organisational Needs. Proceedings of the ... European conference on information warfare and security. ISSN 2048-8602. p. 80–89. doi: 10.34190/EWS.21.043. Full text in Research Archive Show summary

  Digitalisation is more actual than ever and even forced by the Covid-19 pandemic for many. The evolution of technology enables everyone and everything to be connected. This is one of the reasons why cyber security is important to society as it makes the large majority vulnerable to cyber-attacks. Cyber-attacks not only impact confidentiality, integrity and availability of information but also can cause physical damage like Stuxnet. Notably, humans are considered the weakest link in cyber security. Training plays an important role in strengthening the weakest link. A survey was conducted with the aim of developing a serious game for cyber security training where we found that current cyber security trainings are not effective in practice. The survey results showed that the conventional training method is both widely used and at the same time considered the least preferred training method. On the other hand, the game-based training method seems to be the least used training method, but this seems to be one of the most preferred training methods. Existing serious games in cyber security are “generic” as they do not seem to neither consider end-user preferences nor can be tailored to the specific and varying needs of an organisation. Therefore, a survey was conducted in an organisation to elicit end-user preferences. This was complemented with interviews of key management personnel to gather organisational needs. Based on the analysis of survey and interview results, a set of requirements are provided for developing a serious game for cyber security training in a specific organisation.

• Katta, Vikash; Sechi, Fabien; Jørgensen, Per-Arne; Strand, Stine; Wiig, Per Axel & Simensen, John Eidar [Show all 7 contributors for this article] (2019). Establishing a cybersecurity centre for industrial control systems. In Beer, Michael & Zio, Enrico (Ed.), Proceedings of the 29th European Safety and Reliability Conference(ESREL). 22 – 26 September 2019 Hannover, Germany. Research Publishing Services. ISSN 9789811127243. doi: 10.3850/978-981-11-2724-3_0528-cd. Full text in Research Archive

View all works in NVA

• Sechi, Fabien & Chockalingam, Sabarathinam (2021). Cyber and Network Security: A Bird’s Eye View. Full text in Research Archive

View all works in NVA