Real-time detection of stealthy IoT-based cyber-attacks on power distribution systems: A novel anomaly prediction approach

• Published in: Electric power systems research 2023-10, Vol.223, p.109496, Article 109496
• Main Authors: Sawas, Abdullah, Farag, Hany E.Z.
• Format: Article
• Language: English
• Subjects: Anomaly detection; Cyber physical security; IoT; Power distribution system
• ISSN: 0378-7796; 1873-2046
• DOI: 10.1016/j.epsr.2023.109496

IoT-enabled appliances are essential components in the development of modern smart homes and cities as they offer energy-efficient solutions that bring comfort to customers, resulting in a better quality of life. Despite the advantages, these smart appliances also present new privacy and security challenges that create vulnerabilities in both smart homes and Power Distribution Systems (PDSs), ultimately affecting their efficiency and reliability. Hence, identifying the security risks linked with behind-the-meter (BTM) IoT-enabled appliances is crucial to develop appropriate countermeasures for safeguarding the PDSs. Previous studies have primarily focused on developing countermeasures for attacks on utility-scale domains, while the problem of attack detection has been largely neglected in the literature. This paper fills the gap by presenting a stealthy attack model applied to a group of compromised IoT-enabled appliances manipulating their operation to deteriorate the power quality of a PDS. The presented attack minimizes the chance of getting detected by maintaining the operating conditions of such appliances within the consumers’ comfort levels. Then, a novel real-time anomaly detection and prediction method is proposed based on demand power spectrum analysis and Long-short-term memory (LSTM) neural networks. Further, a Feeder Loading Abnormal Power Spectrum (FLAPS) index is introduced and utilized to estimate the attack onset time, which is then reported to the PDS’s operator for further investigation and action. The evaluation of the stealthy attack model and the anomaly prediction approach is carried out on a residential community modeled using the IEEE-13 bus power distribution feeder, which exhibits various power consumption patterns and appliance operation schedules. The effects of the proposed stealthy attack on the PDS are analyzed quantitatively by examining the occurrences of voltage violations and the wear and tear of the line voltage regulator (LVR) of the system. Numerical results show that compromising only 5% of the PDS’s load, the LVR operates 1.8 more times than during normal conditions. This impact increases to 8 times at 50% compromised load with many voltage violation cases. Also, the simulation results demonstrate the superiority of the proposed prediction technique to detect stealthy attacks 50% faster than threshold-based approaches, thereby enabling the system’s operator to take faster actions. •Present covert IoT attacks to degr