CIM–ThreMA cross-domain ontology — thesis write-up
M.Sc. thesis, RWTH Aachen, 2025
A cross-domain ontology linking grid topology (CIM/CGMES) with a threat-modelling ontology (ThreMA), so that security analysis can follow topology changes instead of being re-derived by hand. Implemented as a runnable simulator on an IEEE 9-bus cyber-physical testbed.
physics-informed.vercel.apprepo path not public
Problem
Grid engineering models (CIM/CGMES) and OT threat models (ThreMA) carry no shared semantics. When the topology changes, the threat analysis does not follow; it is redone manually or not at all. For a substation-scale system that gap is where errors live.
Approach
Five formal semantic mappings between the CIM and ThreMA ontologies, with the grid side expressed in CGMES profiles. The mappings are exercised on an IEEE 9-bus cyber-physical testbed with four documented attack scenarios. A Q-learning agent acts as the security decision layer over the joint model; a cross-domain signal-to-noise metric scores how much of each mapping survives the translation.
Validation
Validation is confined to the IEEE 9-bus testbed and the four scenarios defined in the thesis. The mapping catalogue, the scenario definitions and the agent configuration ship in the public deployment so that the results can be re-run rather than quoted. Figures are stated in the thesis, not on this site.
Limits
A research artifact. The testbed is small, the scenario set is closed, and the reinforcement-learning layer is a proof of feasibility, not a certified controller. Nothing here has been assessed against a functional-safety or security standard, and no such claim is made.