A Cyber-Physical Anomaly Detection for Wide-Area Protection Using Machine Learning

Abstract

Wide-area protection scheme (WAPS) provides system-wide protection by detecting and mitigating small and large-scale disturbances that are difficult to resolve using local protection schemes. As this protection scheme is evolving from a substation-based distributed remedial action scheme (DRAS) to the control center-based centralized RAS (CRAS), it presents severe challenges to their cybersecurity because of its heavy reliance on an insecure grid communication, and its compromise would lead to system failure. This paper presents an architecture and methodology for developing a cyber-physical anomaly detection system (CPADS) that utilizes synchrophasor measurements and properties of network packets to detect data integrity and communication failure attacks on measurement and control signals in CRAS. The proposed machine leaningbased methodology applies a rules-based approach to select relevant input features, utilizes variational mode decomposition (VMD) and decision tree (DT) algorithms to develop multiple classification models, and performs final event identification using a rules-based decision logic. We have evaluated the proposed methodology of CPADS using the IEEE 39 bus system for several performance measures (accuracy, recall, precision, and F-measure) in a cyber-physical testbed environment. Our experimental results reveal that the proposed algorithm (VMD-DT) of CPADS outperforms the existing machine learning classifiers during noisy and noise-free measurements while incurring an acceptable processing overhead.

A Comprehensive Review of Cybersecurity in Inverter-Based Smart Power System Amid the Boom of Renewable Energy

“…In [148], the anomaly detector for WAMPAC uses variational mode decomposition for feature extraction of PMU measurement, which is then used to train the decision tree algorithm to detect and classify events, either FDIA, DoS attacks, line fault or malicious tripping. The time-frequency logic formalism and continuous wavelet transform method in [136] can detect FDIA, DoS attack along with physical fault in both AC and DC microgrid, even with noisy data input.…”

NEFTSec: Networked federation testbed for cyber‐physical security of smart grid: Architecture, applications, and evaluation

“…Detection (Defence) Module: It includes state-of-the-art detection and defence solutions, such as rule, model, and machine learning-based anomaly detection systems, moving target defence, etc., as developed in earlier research efforts [23,24], which can be utilised to test, validate, and evaluate system performances with a detailed network analysis using this NEFTSec platform.…”

“…This provides a high fidelity representation of geographically dispersed grid elements for industrial, academic, and broader public users. Remote Access : Provides remote access capability to multiple users using internet‐based network interfaces to conduct multiple and coordinated cybersecurity‐based attack‐defence experiments [20]. Testing , Validation , and Evaluation : Since the current operational systems cannot be utilised to perform cyber‐physical security‐related experiments, the NEFTSec provides a platform to test, validate, and evaluate the performances of state‐of‐the‐art research and engineering solutions in real time. Demonstration and Training : Provides a unique demonstration platform by simulating realistic cyberattacks and possible defence measures [23, 24]. In addition, it serves as a powerful training ground to provide hands‐on cybersecurity training and hacking exercises in grid security. Quality of Service (QoS) : Supports QoS assessments by analysing network packets for data latency, packet loss, and communication bandwidth for a reliable communication network between CPS testbeds. Heterogeneity and Modularity : Incorporates heterogeneity by simulating different components of power systems utilising phasor and transient simulations as well as performing hybrid simulations.…”

“…Demonstration and Training : Provides a unique demonstration platform by simulating realistic cyberattacks and possible defence measures [23, 24]. In addition, it serves as a powerful training ground to provide hands‐on cybersecurity training and hacking exercises in grid security.…”

“…Cyberattack Module : It includes a library of software components that are grouped together as a module to implement cyberattacks in a federated testbed environment. This module includes IT‐based attacks (ping, nmap scanning, and OpenVAS scanning), single cyberattacks (line tripping attack and denial of service attack), stealthy cyberattacks (Man‐in‐the‐Middle (MITM) attack and malware installation), etc., and coordinated cyberatttacks as discussed in previous works [6, 23, 24].…”