Multivariate Gaussian-Based False Data Detection Against Cyber-Attacks

Abstract

Modern distribution power system has become a typical cyber-physical system (CPS), where reliable automation control process is heavily depending on the accurate measurement data. However, the cyber-attacks on CPS may manipulate the measurement data and mislead the control system to make incorrect operational decisions. Two types of cyber-attacks (e.g., transient cyber-attacks and steady cyberattacks) as well as their attack templates are modeled in this paper. To effectively and accurately detect these false data injections, a multivariate Gaussian based anomaly detection method is proposed. The correlation features of comprehensive measurement data captured by micro-phasor measurement units (µPMU) are developed to train multivariate Gaussian models for the anomaly detection of transient and steady cyberattacks, respectively. A k-means clustering method is introduced to reduce the number of µPMUs and select the placement of µPMUs. Numerical simulations on the IEEE 34 bus system show that the proposed method can effectively detect the false data injections on measurement sensors of distribution systems. INDEX TERMS Cyber-physical system, cyber-attack, anomaly detection, distribution grid, machine learning. I. INTRODUCTION Information technology plays a critical role in the automatic control of modern distribution power systems, which consist of a large number of computation systems, local sensors, and communication networks. With the increasing and deep interaction between physical flow and cyber flow, the modern distribution system becomes a typical cyber-physical system (CPS) [1], [2]. The core of CPS in power grids is to achieve high-sensitivity awareness and real-time automation of physical processes through the integration and coordination of 3C (Computation, Communication, and Control) technology [3]-[5]. The integration of cyber networks and physical systems has significantly enhanced the efficiency and reliability of distribution system operations. However, the strong interdependence between cyber networks and physical power grids can bring more potential risks through complex communication links, which are significantly vulnerable to cyber security threats [6]. In addition, both the privatization of energy industries and the standardization of The associate editor coordinating the review of this article and approving it for publication was Mingjian Cui.

Denoising and Bad Data Detection in Distribution Phasor Measurements using Filtering, Clustering and Koopman Mode Analysis

“…Wavelet transform has been used widely for transient analysis in the power system [9], [10], [11] and is employed for signal smoothing in this work. We combine the results from a variety of base anomaly detectors such as Hampel filter [12], Quartile technique, and DBSCAN using MB-MLE.…”

A Degradation Fault Prognostic Method of Radar Transmitter Combining Multivariate Long Short-Term Memory Network and Multivariate Gaussian Distribution

“…The historical data in [21] needs to provide time series with equal time intervals. In the experiment, the number of fault samples adopted by [22] and [23] is almost equal to that normal samples. [24] verifies that the supervised learning method is not suitable when the number of fault samples is small.…”

Detecting load redistribution attacks via support vector models

“…Various attack detection techniques have been presented in the literature. In [6], the authors propose a multivariate Gaussian‐based anomaly detector trained using correlation features of micro phasor measurement units (μPMUs), but this detector requires the installation of μPMUs in the system. Liu et al [7] detect and identify attacks using reactance perturbation, but this method only works when the attacker has limited resources.…”

“…Estimation–detection framework: In this study, we introduce an LR attack detection framework based on support vector models by leveraging the historical load information commonly available to system operators. While there are existing approaches in the literature to prevent attacks by installing new devices [6] or protecting specific measurements [10], guiding operators to utilise existing data available to design software‐based solutions is complementary to those existing approaches. Our method determines the existence of LR attacks directly through the estimated loads, which can be conveniently applied in conjunction with the current EMS operations.…”