Real-Time Detection of False Data Injection in Smart Grid Networks: An Adaptive CUSUM Method and Analysis

Abstract

Abstract-Smart grid is delay-sensitive and requires the techniques that can identify and react on the abnormal changes (i.e. system fault, attacker, shortcut, etc.) in a timely manner. In this paper, we propose a real-time detection scheme against false data injection attack in smart grid networks. Unlike the classical detection test, the proposed algorithm is able to tackle the unknown parameters with low complexity and process multiple measurements at once, leading to a shorter decision time and better detection accuracy. The objective is to detect of adversary as quickly as possible while satisfy certain detection error constraints. A Markov chain based analytical model is constructed to systematically analyze the proposed scheme. With the analytical model, we are able to configure the system parameters for guaranteed performance in terms of false alarm rate, average detection delay, and missed detection ratio under a detection delay constraint. The Simulations are conducted with MATPOWER 4.0 package for different IEEE test systems.

Reliability Modeling Considerations for Emerging Cyber-Physical Power Systems

“…), which are desired for seamless operation of a power system. Estimated conditions of operating states from real-time measurements are used for this purpose [13]. Failure of the decision tools, including servers, will affect power system reliability.…”

Defense Mechanisms against Data Injection Attacks in Smart Grid Networks

“…In power flow analysis, it is usually considered that the voltage phase differences are relatively small and the voltage amplitudes are normalized to unit [8], such that a linear relation exists between the power measurement and the voltage phase difference. We thus apply a linearized power flow model, which is widely used for real-time analysis of state estimation in the power systems [11].…”

“…1) Non-stealthy Data Injection Attacks: They are defined as the attacks detectable by conventional residual-test methods [8]. In this case, the measurement matrix H is not known to the attackers.…”

“…This ML technique relies on a set of historical data that is used for learning and validating data to detect the attacks in new measurements, and the learning efficiency needs to be improved. A cumulative-sum-based (CS) approach is proposed in [8] aiming to minimize the detection time subject to certain detection error constraints; but this CS approach focuses on non-stealthy attacks. Exploiting the low rank structure of temporal June 27, 2017 DRAFT erroneous-free measurements and sparsity of malicious attacks, defense mechanisms are proposed in [10] and [9], where methods of constructing sparse stealthy attacks are also studied in [9]; these mechanisms have a strong assumption that the attack matrix must be spare, which is not robust against attackers with strong capability of launching cyber attacks.…”

“…These measurements are then processed at the state estimator for estimating the system states and building real-time electricity network models [8]. These state estimates are crucial, and must June 27, 2017 DRAFT be passed to enable EMS application functions, such as automatic generation control and optimal power flow, to control the physical aspects of power grids.…”