Fast Sequence Component Analysis for Attack Detection in Smart Grid

Abstract

Modern power systems have begun integrating synchrophasor technologies into part of daily operations. Given the amount of solutions offered and the maturity rate of application development it is not a matter of "if" but a matter of "when" in regards to these technologies becoming ubiquitous in control centers around the world. While the benefits are numerous, the functionality of operator-level applications can easily be nullified by injection of deceptive data signals disguised as genuine measurements. Such deceptive action is a common precursor to nefarious, often malicious activity. A correlation coefficient characterization and machine learning methodology are proposed to detect and identify injection of spoofed data signals. The proposed method utilizes statistical relationships intrinsic to power system parameters, which are quantified and presented. Several spoofing schemes have been developed to qualitatively and quantitatively demonstrate detection capabilities.

Smart Grids Data Analysis: A Systematic Mapping Study

“…C9. Security Intrusion detection ( [8], [15], [52], [74], [76], [77], [143], [148], [209]),false data injection attacks ( [13], [16], [17], [31], [100], [119], [151], [163], [168], [184], [185], [230], [251], [257]), energy theft ( [54], [99], [169], [191], [254], [258]), distinguishing cyber-attacks from physical faults ( [18])…”

Power System Spoof Detection with a Hybrid Hardware/Software Benchmarking Framework

“…Previous work determined that inter-PMU correlations were useful for detecting spoofs on transmission level PMU data [10]. Inter-PMU correlations are calculated as the Pearson correlation coefficients for one measurement type for any pair of PMUs on the network.…”

“…Inter-PMU correlations are calculated as the Pearson correlation coefficients for one measurement type for any pair of PMUs on the network. Since it was anticipated that the inter-PMU correlations would be weaker on the distribution data, we focus on the strongest correlations identified in [10]. Namely, inter-PMU correlations in frequency (f ), positive sequence voltage magnitude (|V 1 |), and positive sequence voltage angle (φ 1 ).…”

“…Therefore, it is important for system operators to be able to detect an intrusion, specifically when the data reported from the grid has been spoofed and is the result of an adversary changing real measurements to artificially-generated data. Previous work has been done detecting spoofed data in measurements from the transmission level of the power grid [10]. However, the threats posed by compromised AMI affect the distribution level.…”

“…It is anticipated that threats at this level will be harder to detect due to the higher varieties of loads and smaller amounts of electrical coupling between locations of different areas of the distribution network. Our work seeks to improve the work in [10], and show that the methods in that research can extend to the distribution level. To do this, we leverage our inter-institution phasor measurement unit (PMU) network to test the performance of two spoof detection metrics.…”