COCOON strengthening cyber protection for Europe’s power grids

The COCOON project (COoperative Cyber prOtectiON for modern power grids) is a Horizon Europe initiative developing advanced cybersecurity solutions to protect modern, digitalised power grids and critical energy infrastructures.

By combining cybersecurity algorithms, the COCOON programmable node (CPN) and a monitoring dashboard, the project detects and mitigates cyber threats in real time, as illustrated in Figure 1.

Bringing together a multidisciplinary consortium consisting of research institutions, industrial partners and energy stakeholders, the project aims to advance the technological maturity of the developed solutions from TRL3–4 to TRL6–7 through large-scale demonstrations and integration within real operational environments including renewable energy plants, energy communities and digital substations across Europe.

COCOON methodology

COCOON follows a three step approach to improve the cybersecurity of modern electricity networks.

Identifying vulnerabilities

The project first analyses potential cybersecurity threats affecting power systems. Using threat modelling and vulnerability assessment, COCOON identifies how cyberattacks could target key components of the grid such as renewable power plants, substations and energy communities.

This analysis helps understand risks such as manipulation of measurement signals, communication attacks and false data injection. Understanding these vulnerabilities is essential for designing effective detection and mitigation strategies.

Detecting cyber anomalies

The second step focuses on detecting abnormal behaviour in the grid using power system state estimation techniques. By comparing measured electrical data with the expected behaviour of the power system, the false data injection identification (FDII) algorithm can identify inconsistencies that may indicate cyber manipulation or falsified measurements [1].

The false data injection identification algorithm is particularly effective in modern, digitalised grid environments, where distributed assets such as photovoltaic plants, energy communities and smart devices interact with the electricity network. By detecting injected false data, the algorithm contributes to protecting system stability, ensures accurate control signals and prevents potential disruptions caused by cyberattacks.

Real-time cyber protection

The third step focuses on real-time monitoring and protection. COCOON develops an innovative technology called the COCOON programmable node (CPN), which allows cybersecurity applications to run directly within communication networks [2].

The COCOON programmable node integrates several key components:

• The cybersecurity layer (CSL) provides a platform for third party services using any programming language via a compatible API, supporting computationally intensive applications like ML-based cyber protection.
• The input/output layer (IOL) connects the cybersecurity layer to the communication layer (COMML), handling API requests, managing micro-network functions (µNFs), and coordinating data exchange.
• The communication layer performs low level packet processing through its PDP and micro-network functions, extracting or modifying packet fields and processing network traffic for monitoring and threat mitigation.

These components are seamlessly integrated into the COCOON toolset dashboard [3], which provides operators with monitoring tools, anomaly detection algorithms and decision-support dashboards.

Together, the COCOON programmable node and toolset dashboard form a comprehensive early warning system (EWS) that embeds cyber defences close to operational devices, reduces latency, improves responsiveness and enables operators to detect and respond quickly to potential cyber threats.

COCOON builds upon existing technologies developed in previous projects that are currently at TRL4. Through further development and integration of new technologies, the solution will progress to TRL5 [4][5][6]. The components will then be validated in laboratory environments that replicate the real pilot conditions, reaching TRL6. Finally, through demonstration in four real pilot environments, the COCOON solution will achieve TRL7.

Results

The technologies developed in COCOON are validated through four pilot demonstrations representing key parts of the modern power system.

Renewable power plants – Andalusia, Spain

This pilot focuses on cybersecurity for operational PV plants, targeting power plant controllers that manage distributed renewable energy systems.

The pilot evaluates vulnerability assessment, risk profiling and the COCOON early warning system in a real 5MW, 20kV PV plant, testing cyberattack scenarios such as DDoS and false data injection.

COCOON tools monitor communication channels, detect manipulated measurements and ensure resilient, reliable operation while minimising any impact on energy production.

Energy communities – Chalkidiki, Greece

The Chalkidiki pilot focuses on cybersecurity in a distributed renewable-enabled energy community, managed by IKE and interfacing with the Greek DSO, HEDNO.

The pilot evaluates the COCOON solution in detecting and mitigating composite cyberattacks during remote monitoring and control of PV panels for ancillary services provisioning.

COCOON tools monitor voltage, frequency and reactive power, detect anomalies and provide fast incident reporting and threat mitigation. The pilot aims to reach TRL6–7, demonstrating a realistic operational setup for ancillary service instrumentation in an energy community.

Digital substations – Delft, Netherlands

A third pilot focuses on cybersecurity in digital substations within smart grids, led by ENCS.

The pilot demonstrates COCOON innovations in real-life scenarios, monitoring IT-OT communication networks and operating a cyber range for training and attack simulations.

COCOON tools detect and mitigate cyber threats, secure substation communications and strengthen grid resilience.

The pilot evaluates detection accuracy, response time and incident reporting, ensuring the safe operation of European power systems.

Regional coordination centre – Thessaloniki, Greece

Another pilot focuses on the regional coordination centre operated by SELENE-RCC SEE in Thessaloniki, which supports the coordination of TSOs in southeast Europe.

The COCOON tools analyse grid models and exchanged operational data to detect anomalies and cyber attack patterns.

This pilot evaluates COCOON’s early warning and incident response capabilities in a dedicated environment, helping ensure the security and reliability of regional electricity system coordination.

Towards secure digital power systems

As electricity systems become more digital and decentralised, cybersecurity becomes a fundamental requirement for reliable grid operation.

The COCOON project demonstrates how combining power system intelligence with advanced cybersecurity technologies can significantly enhance grid resilience.

By integrating monitoring, anomaly detection and real-time protection tools, COCOON helps ensure that Europe’s electricity networks remain secure as the energy transition accelerates.

To learn more about COCOON and its activities, visit the project website.

References

1. COCOON Project Consortium, Deliverable D2.1, 2025.
2. COCOON Project Consortium, Deliverable D1.2, 2024.
3. COCOON Project Consortium, Deliverable D4.2, 2025.
4. A. Presekal, A. Stefanov, I. Semertzis, and P. Palensky, 2025. 'Spatio-Temporal Advanced Persistent Threat Detection and Correlation for Cyber-Physical Power Systems Using Enhanced GC-LSTM', IEEE Transactions on Smart Grid, doi: 10.1109/TSG.2024.3474039.
5. K.-N. D. Malamaki, C. Mitakos, J. M. Mauricio, and C. Demoulias, 2024. 'Parametric Control Design for Recovery of Fast Storage Systems after Virtual Inertia Provision', in Proc. 2024 IEEE 22nd Mediterranean Electrotechnical Conf. (MELECON), doi: 10.1109/MELECON56669.2024.10608615.
6. Z. Tan, S. P. Parambath, C. Anagnostopoulos, J. Singer, and A. K. Marnerides, 2025. 'Advanced Persistent Threats Based on Supply Chain Vulnerabilities: Challenges, Solutions, and Future Directions', IEEE Internet Things J., doi: 10.1109/JIOT.2025.3528744.

About the authors

Fotios Fotellis graduated in Electrical and Computer Engineering from the Aristotle University of Thessaloniki. He works at HEDNO SA in the Research and Innovation Department, contributing to the COCOON project. His work focuses on renewable energy integration, grid digitalisation and cybersecurity solutions for modern power systems through real pilot implementations.

Konstantinos M. Gektidis holds an M.Eng in Electrical and Computer Engineering from Aristotle University of Thessaloniki and is a PhD candidate at its High Voltage Laboratory. He works at HEDNO SA, focusing on surge protection systems and the pilot implementation of the COCOON project in Greece.