Correlative monitoring for detection of false data injection attacks in smart grids

Abstract

The overarching objective of the modernized electric grid, the smart grid, is to integrate two-way communication technologies across power generation, transmission and distribution to deliver electricity efficiently, securely and costeffectively. However, real-time messaging exposes the entire grid to security threats ranging from attacks that disable information exchange between smart meters and data fusion centers to spurious payload content that would lead to incorrect assessment of actual demand. Such nefarious activities can compromise grid stability and efficiency. Hence, it is important to ensure secure communications and quickly detect malicious activity; this article proposes a framework for detection of false data injection attacks in smart grids. We present a measurement-based situation awareness framework that combines evidence from sensors at home-area networks, and aims to infer anomalies that signify a coordinated, well-orchestrated attack on residential smart meters at increasing spatial scales. By leveraging multi-view sensor readings, we present a Bayesian-based correlative monitoring approach that quickly detects power shifts to anomalous regimes. We evaluate our algorithms using real-world power traces.

Diagnosing False Data Injection Attacks in the Smart Grid: a Practical Framework for Home-area Networks

“…For completeness, we next present an overview of our statistical anomaly detection module. Further details can be found in our previous work [8].…”

“…The optimal parameter vector w * in y(x, w) is obtained by maximizing the posterior distribution, and equals w * = m N . The model hyper-parameters α and β are learned through the iterative process we describe in [8]. Implementation details and our code are in [10].…”

“…After the completion of the algorithm's training period, each set of observations x n acquired every 15 seconds is utilized by the "Data Analyst Pi" to obtain an estimate/prediction,t n := y(x n , w * ), of the house power consumption for that time point. The "Data Analyst Pi" compares this prediction with the actual power consumption reported by the smart meter at the same time slot, and significant differences between the two are flagged as anomalies by the sequential hypothesis testing methodology we proposed in [8].…”

“…Our main contributions are twofold: 1) we illustrate the design and implementation of a situational-awareness system in home-area networks using broadly accessible IoT devices-our original prototype was engineered with devices that cost roughly 400 USD; and 2) we leverage the sensor measurements obtained from our situational-awareness system to transition to practice an anomaly detection methodology for diagnosing bad data injection attacks in smart grids. The monitoring algorithm, recently proposed by our team in [8], utilizes the sensor readings to learn, in a correlative manner, their association with the home's power consumption. This is achieved by fitting a linear regression model that is hence employed to forecast the energy usage using the independent observations (i.e., the wireless sensor readings).…”

“…This is achieved by fitting a linear regression model that is hence employed to forecast the energy usage using the independent observations (i.e., the wireless sensor readings). Large deviations between the actual meter values and the predicted values are flagged as anomalies by our sequential hypothesis testing module (see [8] for more details). Our prototype is currently being utilized in a real-world setting at a model house (see [9]) at NextEnergy, Inc. 1 Code can be downloaded from [10].…”