Towards Real-Time Distinction of Power System Faults and Cyber Attacks

This paper presents a methodology to distinguish between three-phase faults and GOOSE cyber attacks, aimed at opening the circuit breakers in the power grid. We propose a scheme that utilizes Phasor Measurement Unit (PMU)-enabled monitoring of power grid states, and communication network packet logs...

Full description

Saved in:
Bibliographic Details
Main Authors: Abedi, Ali, Rajkumar, Vetrivel S., Stefanov, Alexandru, Palensky, Peter
Format: Conference Proceeding
Language:English
Subjects:
anomaly detection
Circuit faults
cyber attacks
cyber security
Data models
Phasor measurement units
Power grids
Power system faults
Real-time systems
Substations
synchrophasor
Online Access:Request full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:This paper presents a methodology to distinguish between three-phase faults and GOOSE cyber attacks, aimed at opening the circuit breakers in the power grid. We propose a scheme that utilizes Phasor Measurement Unit (PMU)-enabled monitoring of power grid states, and communication network packet logs in the substation. In this scheme, by leveraging both cyber and physical data correlations and applying a Seasonal Autoregressive Moving Average (SARMA) model, we successfully distinguish between 3-phase faults and cyber attacks. The proposed scheme is tested using the benchmark IEEE 9-bus system, and can distinguish cyber attacks from faults in less than 0.2s. This demonstrates the usefulness of the proposed scheme for power system cyber security analytics.
ISSN:1944-9933
DOI:10.1109/PESGM52003.2023.10253241