Cybersecurity Analytics using Smart Inverters in Power Distribution System: Proactive Intrusion Detection and Corrective Control Framework

Fard, Amin Y.; Easley, Mitchell; Amariucai, George T.; Shadmand, Mohammad B.; Abu‐Rub, Haitham

doi:10.1109/hst47167.2019.9032978

Cited by 21 publications

(4 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This is an obvious resultant form multiplication of the local PCC phasor voltage by its complex conjugate. Thereby, ( 9) can be rewritten as (10).…”

Section: B Safe Operation Region "Ie Morphism 2"mentioning

confidence: 99%

“…The futuristic 100% nonsynchronous generation-based power grid targeted in 2050 by the U.S. Department of Energy is anticipated to be vulnerable to malicious cyberattacks. This is because of the more dispersed generation that will operate outside the realm of old-fashioned power-plant administrative domain through employing more DEGs at the grid edge [10][11][12][13][14]. The attack might be introduced into the PEDG infrastructure through the communication medium that enables its harmonious operation.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Intrusion Detection System for Multilayer-Controlled Power Electronics-Dominated Grid

2022

Self Cite

View full text Add to dashboard Cite

This article presents an intrusion detection system (IDS) for a multi-layer-controlled power electronics-dominated grid (PEDG). This IDS improves the situational awareness of PEDG against malicious set-points from a compromised upper control layer. Firstly, a mathematical theory is developed for deriving a safe operation region. This mathematical theory extends the stability margins inferred from 𝑃 − 𝑉 curves to the abstract concept of morphisms. Particularly, there are two morphisms for each point of common coupling (PCC) bus when operating in the safe operation region: (Morphism 1) PCC bus voltage mapped to network set-points, and (Morphism 2) network set-points mapped to PCC bus voltage. Morphism 1 is used for anomaly detection. Explicitly, observation of a non-zero imaginary-part in the PCC voltage L2 norm is evidence of an anomaly. Morphism 2 is utilized for independent decision making at the primary layer of the dispersed energy generator (DEG) during intrusion scenarios. Morphism 2 is an alternative for the secondary layer when the dispatched set-points are not trusted. The theoretical analysis is verified by several case studies to substantiate the situational awareness against malicious set-points and consequently enhancing the cybersecurity aspects of the PEDG.

show abstract

“…This is an obvious resultant form multiplication of the local PCC phasor voltage by its complex conjugate. Thereby, ( 9) can be rewritten as (10).…”

Section: B Safe Operation Region "Ie Morphism 2"mentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Intrusion Detection System for Multilayer-Controlled Power Electronics-Dominated Grid

2022

Self Cite

View full text Add to dashboard Cite

show abstract

“…Most existing work focuses on potential attack vectors and best practices for proactive cybersecurity, but there are a few papers that discuss attack detection and mitigation. A tool to flag anomalous smart inverter behavior has been developed [63]. This tool also proposed a cyberattack detection mechanism based on anomaly detection using data from geographically separated DER.…”

Section: Anomaly Detectionmentioning

confidence: 99%

Securing Distributed Energy Resource Integration

Culler

2021

View full text Add to dashboard Cite

The penetration of distributed energy resources (DER) is growing at much higher rates than predicted 20 years ago. Far from being used only in residential settings, DER are now installed on distribution and transmission circuits. In this position, they do not have the same properties as traditional generators and are more flexible in many cases. The growing penetration and range of uses for DER motivate the need to reliably and safely integrate them into the grid. Operators must be able to rely on them not only for normal operation, but also during abnormal conditions like black starts or adverse cyber scenarios. To that end, we study the communications, device interfaces, and potential consequences of DER operation under abnormal and adversarial conditions. The weaknesses of communications networks are studied based on the industrial protocols used, and the benefits of security features are examined. The device interfaces are found to be vulnerable to attack based on the requirements in the IEEE-1547 standard for DER interconnection and interoperability, which is expected to be adopted in the next ten years. In addition to exploring the requirements of the standard, we show that these vulnerabilities and others do exist and can be used maliciously in a modern storage system DER. Consequences of these vulnerabilities range from exacerbated grid instability, to simultaneous loss of large portions of DER penetration, to physical damage to inverters or DER themselves and other sensitive equipment. We tie these outcomes to specific attacker actions in an effort to give operators a better threat intelligence view that allows them to prioritize mitigations. Finally, we discuss mitigations that could prevent many of the adversarial scenarios described. Some solutions can be added to existing infrastructure, while others may require longer term planning for grid modernization with consideration for security.

show abstract

“…Detailed protocol and communications security for DER applications is discussed in [10]. DER and smart inverter functions can even be used to help detect broader attacks on the power system [48]. Advanced methods of cybersecurity traditionally applied to enterprise can also be adapted to DER environments [49,50].…”

Section: Related Workmentioning

confidence: 99%

Cybersecurity Considerations for Grid-Connected Batteries with Hardware Demonstrations

Culler

Burroughs

2021

Energies

View full text Add to dashboard Cite

The share of renewable and distributed energy resources (DERs), like wind turbines, solar photovoltaics and grid-connected batteries, interconnected to the electric grid is rapidly increasing due to reduced costs, rising efficiency, and regulatory requirements aimed at incentivizing a lower-carbon electricity system. These distributed energy resources differ from traditional generation in many ways including the use of many smaller devices connected primarily (but not exclusively) to the distribution network, rather than few larger devices connected to the transmission network. DERs being installed today often include modern communication hardware like cellular modems and WiFi connectivity and, in addition, the inverters used to connect these resources to the grid are gaining increasingly complex capabilities, like providing voltage and frequency support or supporting microgrids. To perform these new functions safely, communications to the device and more complex controls are required. The distributed nature of DER devices combined with their network connectivity and complex controls interfaces present a larger potential attack surface for adversaries looking to create instability in power systems. To address this area of concern, the steps of a cyberattack on DERs have been studied, including the security of industrial protocols, the misuse of the DER interface, and the physical impacts. These different steps have not previously been tied together in practice and not specifically studied for grid-connected storage devices. In this work, we focus on grid-connected batteries. We explore the potential impacts of a cyberattack on a battery to power system stability, to the battery hardware, and on economics for various stakeholders. We then use real hardware to demonstrate end-to-end attack paths exist when security features are disabled or misconfigured. Our experimental focus is on control interface security and protocol security, with the initial assumption that an adversary has gained access to the network to which the device is connected. We provide real examples of the effectiveness of certain defenses. This work can be used to help utilities and other grid-connected battery owners and operators evaluate the severity of different threats and the effectiveness of defense strategies so they can effectively deploy and protect grid-connected storage devices.

show abstract

Cybersecurity Analytics using Smart Inverters in Power Distribution System: Proactive Intrusion Detection and Corrective Control Framework

Cited by 21 publications

References 13 publications

Intrusion Detection System for Multilayer-Controlled Power Electronics-Dominated Grid

Intrusion Detection System for Multilayer-Controlled Power Electronics-Dominated Grid

Securing Distributed Energy Resource Integration

Cybersecurity Considerations for Grid-Connected Batteries with Hardware Demonstrations

Contact Info

Product

Resources

About