Lightweight Moving Target Defense for Robust Intrusion Detection in Smart Grids

Smart grids rely heavily on network protocols, e.g., classic Modbus TCP for substation communications, yet conventional learning-based intrusion detectors overfit to spurious correlations and crumble under adversarial or distributional shifts. In this work, we introduce a lightweight Moving Target Defense (MTD) proxy that randomizes the Modbus slave address on each TCP session. In our proof-of-concept experiments, a Random Forest detector under MTD maintains 95% detection accuracy while, in the eXplainable Artificial Intelligence (XAI) sense, its reliance on the address field drops, and payload-related features gain prominence. We further demonstrate that simple deterministic checks and dynamic honeypots can complement MTD to protect integrity, availability, and confidentiality with minimal or no machine learning. Our results highlight that even modest MTD interventions can substantially harden smart-grid intrusion detection systems against both inadvertent shifts and targeted evasion.