Detecting Data Manipulation Attacks on the Substation Interlocking Function Using Direct Power Feedback

Abstract

Any form of deliberate physical or cyber activity that attempts to undermine the control mechanisms that maintain the key goals of reliability, efficiency and safety of a physical system can be considered to be an attack on the system. Indeed, an attack can be as subtle as a configuration change that prevents the optimal operation of a power system.This chapter describes an approach that enhances the security of the interlocking function in a power distribution substation by using the power flow behavior of the physical system during switching events as direct power feedback. The approach detects potential over-thenetwork data modification attacks on the interlocking function using out-of-bounds sensor measurements. The direct power feedback adds an extra layer of security and redundancy to existing power substation interlocking function protection mechanisms.