This paper presents a hybrid data-driven physics model-based framework for real time monitoring in smart grids. As the power grid transitions to the use of smart grid technology, it's real time monitoring becomes more vulnerable to cyber attacks like false data injections (FDI). Although smart grids cyber-physical security has an extensive scope, this paper focuses on FDI attacks, which are modeled as bad data. State of the art strategies for FDI detection in real time monitoring rely on physics model-based weighted least squares state estimation solution and statistical tests. This strategy is inherently vulnerable by the linear approximation and the companion statistical modeling error, which means it can be exploited by a coordinated FDI attack. In order to enhance the robustness of FDI detection, this paper presents a framework which explores the use of data-driven anomaly detection methods in conjunction with physics model-based bad data detection via data fusion. Multiple anomaly detection methods working at both the system level and distributed local detection level are fused. The fusion takes into consideration the confidence of the various anomaly detection methods to provide the best overall detection results. Validation considers tests on the IEEE 118 bus system.

No abstract

No abstract

Smart Grid (SG) research and development has drawn much attention from academia, industry and government due to the great impact it will have on society, economics and the environment. Securing the SG is a considerably significant challenge due the increased dependency on communication networks to assist in physical process control, exposing them to various cyber-threats. In addition to attacks that change measurement values using False Data Injection (FDI) techniques, attacks on the communication network may disrupt the power system's real-time operation by intercepting messages, or by flooding the communication channels with unnecessary data. Addressing these attacks requires a cross-layer approach. In this paper a cross-layered strategy is presented, called Cross-Layer Ensemble CorrDet with Adaptive Statistics(CECD-AS), which integrates the detection of faulty SG measurement data as well as inconsistent network inter-arrival times and transmission delays for more reliable and accurate anomaly detection and attack interpretation. Numerical results show that CECD-AS can detect multiple False Data Injections, Denial of Service (DoS) and Man In The Middle (MITM) attacks with a high F1-score compared to current approaches that only use SG measurement data for detection such as the traditional physics-based State Estimation, ECD-AS strategy and other machine learning classification-based detection schemes.

No abstract