Integration of Information and Communications Technology (ICT) into the distribution system makes today's power grid more remotely monitored and controlled than it has been. The fast increasing connectivity, however, also implies that the distribution grid today, or smart grid, is more vulnerable. Thus, research into intrusion/anomaly detection systems at the distribution level is in critical need. Current research on Intrusion Detection Systems for the power grid has been focused primarily on cyber security at the Supervisory Control And Data Acquisition, and single node levels with little attention on coordinated cyberattack at multiple nodes. A holistic approach toward system-wide cyber security for distribution systems is yet to be developed. This paper presents a novel approach toward intrusion prevention, using a multi-agent system, at the distribution system level. Simulations of the method have been performed on the IEEE 13-Node Test Feeder, and the results compared to those obtained from existing methods. The results have validated the performance of the proposed method for protection against cyber intrusions at the distribution system level.

The Information and Communications Technology (ICT) for control and monitoring of power systems is a layer on top of the physical power system infrastructure. The cyber system and physical power system components form a tightly coupled Cyber-Physical System (CPS). Sources of vulnerabilities arise from the computing and communication systems of the cyber-power grid. Cyber intrusions targeting the power grid are serious threats to the reliability of electricity supply that is critical to society and the economy. In a typical Information Technology environment, numerous attack scenarios have shown how unauthorized users can access and manipulate protected information from a network domain. The need for cyber security has led to industry standards that power grids must meet to ensure that the monitoring, operation, and control functions are not disrupted by cyber intrusions. Cyber security technologies such as encryption and authentication have been deployed on the CPS. Intrusion or anomaly detection and mitigation

An islanded microgrid is cyber-physical system, and the control relies on the communication system significantly. Improper parameters of the cyber system can result in instability of a microgrid system. To evaluate the impact of a networked control system on control performance, a cyber model is developed to represent data acquisition periods and communication delays. Simplification of the networked control system model is proposed to enhance the computational performance, making the analytical method applicable for large-scale systems. Based on the analysis, a two-dimensional stability region of a microgrid in the space of cyber parameters can be obtained. To validate the proposed method, a microgrid control scheme is proposed for power dispatch and regulation based on the droop and proportional-integral (PI) feedback control. The analytical method is compared to the time-domain simulation, and it is shown that the stability regions are nearly identical. The critical values of cyber parameters are determined based on the analytical results. The proposed control strategy with the given cyber parameters is validated for transient stability following dynamic events. Simulation results indicate that the design of a microgrid as a cyber-physical system needs to be guided by critical values for cyber parameters to prevent system instability.

Cyber-physical system security for electric distribution systems is critical. In direct switching attacks, often coordinated, attackers seek to toggle remote-controlled switches in the distribution network. Due to the typically radial operation, certain configurations may lead to outages and/or voltage violations. Existing optimization methods that model the interactions between the attacker and the power system operator (defender) assume knowledge of the attacker's parameters. This reduces their usability. Furthermore, the trend with coordinated cyberattack detection has been the use of centralized mechanisms, correlating data from dispersed security systems. This can be prone to single point failures. In this paper, novel mathematical models are presented for the attacker and the defender. The models do not assume any knowledge of the attacker's parameters by the defender. Instead, a machine learning (ML) technique implemented by a multi-agent system correlates detected attacks in a decentralized manner, predicting the targets of the attacker. Furthermore, agents learn optimal mitigation of the communication level through Q-learning. The learned attacker motive is also used by the defender to determine a new configuration of the distribution network. Simulations of the technique have been performed using the IEEE 123-Node Test Feeder. The simulation results validate the capability and performance of the algorithm.

No abstract