UNB Researchers Deploy Collaborative AI Agents to Guard Power-Substation Networks

Power substations are becoming networked computers, and their network traffic is now a security battleground. A poster from UNB's Canadian Institute for Cybersecurity argues the best defence may be a team of specialized AI agents working together.

Multi-Agent Anomaly Detection for MMS Communications in IEC 61850 Substations, by Samane Bidabadi, Hossein Shokouhinejad, and Kwasi Boakye-Boateng, will be on the wall at the PST Cybersecurity Summit 2026 in Fredericton on Aug. 20.

The problem: traffic that only makes sense in context

Modern substations run on IEC 61850, the standard that lets protection relays, meters, and control systems exchange messages over networks using MMS (Manufacturing Message Specification). Monitoring that traffic is hard: a packet is only meaningful when you understand the network it travels on and what the substation is trying to do operationally. Conventional detectors that look at one layer at a time miss suspicious activity that only shows up across all of them.

The approach: agents that split the work

The proposed framework assigns the job to specialized AI agents, each responsible for a different lens:

• a structural agent reads the network traffic itself
• a semantic agent understands what the messages mean
• a behavioural agent tracks operational intent — what the substation is supposed to be doing

Working together, the agents combine those views into a single anomaly verdict. The researchers report the collaborative setup outperforms individual agents, catching suspicious activities that conventional methods overlook.

Why it matters

Grid operators are digitizing the same critical infrastructure that New Brunswick utilities are already interconnecting across the region — and anomaly detection that understands both the network and the operation is exactly what a modern control room needs. It's also a reminder that Fredericton's security research cluster is reaching well beyond the IT perimeter into industrial and operational technology.

Sources

• Canadian Institute for Cybersecurity: Research Spotlight post — project summary, authors, and the multi-agent approach