Machine Learning Based Detection of False Data Injection Attacks in Wide Area Monitoring Systems

The Smart Grid (SG) is an upgraded, intelligent, and a more reliable version of the traditional Power Grid due to the integration of information and communication technologies. The operation of the SG requires a dense communication network to link all its components. But such a network renders it prone to cyber attacks jeopardizing the integrity and security of the communicated data between the physical electric grid and the control centers. One of the most prominent components of the SG are Wide Area Monitoring Systems (WAMS). WAMS are a modern platform for grid-wide information, communication, and coordination that play a major role in maintaining the stability of the grid against major disturbances. In this thesis, an anomaly detection framework is proposed to identify False Data Injection (FDI) attacks in WAMS using different Machine Learning (ML) and Deep Learning (DL) techniques, i.e., Deep Autoencoders (DAE), Long-Short Term Memory (LSTM), and One-Class Support Vector Machine (OC-SVM). These algorithms leverage diverse, complex, and high-volume power measurements coming from communications between different components of the grid to detect intelligent FDI attacks. The injected false data is assumed to target several major WAMS monitoring applications, such as Voltage Stability Monitoring (VSM), and Phase Angle Monitoring (PAM). The attack vector is considered to be smartly crafted based on the power system data, so that it can pass the conventional bad data detection schemes and remain stealthy. Due to the lack of realistic attack data, machine learning-based anomaly detection techniques are used to detect FDI attacks. To demonstrate the impact of attacks on the realistic WAMS traffic and to show the effectiveness of the proposed detection framework, a Hardware-In-the-Loop (HIL) co-simulation testbed is developed. The performance of the implemented techniques is compared on the testbed data using different metrics: Accuracy, F1 score, and False Positive Rate (FPR) and False Negative Rate (FNR). The IEEE 9-bus and IEEE 39-bus systems are used as benchmarks to investigate the framework scalability. The experimental results prove the effectiveness of the proposed models in detecting FDI attacks in WAMS

False data injection attack detection in smart grid

Smart grid is a distributed and autonomous energy delivery infrastructure that constantly monitors the operational state of its overall network using smart techniques and state estimation. State estimation is a powerful technique that is used to determine the overall operational state of the system based on a limited set of measurements collected through metering systems. Cyber-attacks pose serious risks to a smart grid state estimation that can cause disruptions and power outages resulting in huge economical losses and are therefore a big concern to a reliable national grid operation. False data injection attacks (FDIAs), engineered on the basis of the knowledge of the network configuration, are difficult to detect using the traditional data detection mechanisms. These detection schemes have been found vulnerable and failed to detect these FDIAs. FDIAs specifically target the state data and can manipulate the state measurements in such a way that these false measurements appear real to the main control systems. This research work explores the possibility of FDIA detection using state estimation in a distributed and partitioned smart grid. In order to detect FDIAs we use measurements for residual-based testing which creates an objective function; and the probability of erroneous data is determined from this residual test. In this test, a preset threshold is determined based on the prior history of the state data. FDIA cases are simulated within a smart grid considering that the Chi-square detection state estimator fails in identifying such attacks. We compute the objective function using the standard weighted least problem and then test the objective function against the value in the Chi-square table. The gain matrix and the Jacobian matrix are computed. The state variables are computed in the form of a voltage magnitude. The state variables are computed after the inception of an attack to assess these state magnitude results. Different sizes of partitioning are used to improve the overall sensitivity of the Chi-square results. Our additional estimator is based on a Kalman estimation that consists of the state prediction and state correction steps. In the first step, it obtains the state and matrix covariance prediction, and in the second step, it calculates the Kalman gain and the state and matrix covariance update steps. The set of points is created for the state vector x at a time instant t. The initial vector and covariance matrix are based on a priori knowledge of the historical estimates. A set of sigma points is estimated by the state update function. Sigma points refer to the minimal set of sampling points that are selected and transformed using nonlinear function, and the new mean and the covariance are formed out of these transformed points. The idea behind this is that it is easier to compute a Gaussian distribution than an arbitrary nonlinear function. The filter gain, the mean and the covariance are used to estimate the next state. Our simulation results show that the combination of Kalman estimation and distributed state estimation improves the overall stability index and vulnerability assessment score of the smart grid. We built a stability index table for a smart grid based on the state estimates value after the inception of an FDIA. The vulnerability assessment score of the smart grid is based on common vulnerability scoring system (CVSS) and state estimates under the influence of an FDIA. The simulations are conducted in the MATPOWER program and different electrical bus systems such as IEEE 14, 30, 39, 118 and 300 are tested. All the contributions have been published in reputable journals and conferences.Doctor of Philosoph

Real-time power system topology change detection and identification

This thesis proposes a framework for detection and identification of system topological changes in near real-time that utilizes the statistical properties of electricity generation and demand, which are assumed to be known. Instead of relying on offline models as with traditional methods, the proposed method is model-free, and exploits the high-speed synchronized measurements provided by phasor measurement units (PMUs). In this framework, a statistical quickest change algorithm is applied to the voltage phase angle measurements collected from PMUs to detect the change-point that corresponds to the system topology change instant. An advantage of this algorithm is that the operator also has full control over the tradeoff between detection delay and false alarm rate. Additionally, a full measurement set is not necessary for its implementation and good results can be achieved even for a few PMU measurements. A scheme for systematic PMU bus selection is presented along with a method to partition the power system such that the aforementioned algorithm for line outage detection can be applied in parallel to each area, allowing for even faster detection. The optimal partitioning scheme is formulated as an integer program and solved using a greedy algorithm. In the second half of the thesis, an adaptive line outage detection algorithm that accounts for the transient dynamics following a line outage is proposed. A more accurate governor power flow model of the power system is used. This new algorithm is shown to have better performance compared to existing algorithms for line outage detection. In order to lend support for the work done in this thesis, case studies are done through simulations on standard IEEE test systems

Real-time Prediction of Cascading Failures in Power Systems

Blackouts in power systems cause major financial and societal losses, which necessitate devising better prediction techniques that are specifically tailored to detecting and preventing them. Since blackouts begin as a cascading failure (CF), an early detection of these CFs gives the operators ample time to stop the cascade from propagating into a large-scale blackout. In this thesis, a real-time load-based prediction model for CFs using phasor measurement units (PMUs) is proposed. The proposed model provides load-based predictions; therefore, it has the advantages of being applicable as a controller input and providing the operators with better information about the affected regions. In addition, it can aid in visualizing the effects of the CF on the grid. To extend the functionality and robustness of the proposed model, prediction intervals are incorporated based on the convergence width criterion (CWC) to allow the model to account for the uncertainties of the network, which was not available in previous works. Although this model addresses many issues in previous works, it has limitations in both scalability and capturing of transient behaviours. Hence, a second model based on recurrent neural network (RNN) long short-term memory (LSTM) ensemble is proposed. The RNN-LSTM is added to better capture the dynamics of the power system while also giving faster responses. To accommodate for the scalability of the model, a novel selection criterion for inputs is introduced to minimize the inputs while maintaining a high information entropy. The criteria include distance between buses as per graph theory, centrality of the buses with respect to fault location, and the information entropy of the bus. These criteria are merged using higher statistical moments to reflect the importance of each bus and generate indices that describe the grid with a smaller set of inputs. The results indicate that this model has the potential to provide more meaningful and accurate results than what is available in the previous literature and can be used as part of the integrated remedial action scheme (RAS) system either as a warning tool or a controller input as the accuracy of detecting affected regions reached 99.9% with a maximum delay of 400 ms. Finally, a validation loop extension is introduced to allow the model to self-update in real-time using importance sampling and case-based reasoning to extend the practicality of the model by allowing it to learn from historical data as time progresses

Detection and Localization of Faults in a Regional Power Grid

The structure of power flows in transmission grids is evolving and is likely to change significantly in the coming years due to the rapid growth of renewable energy generation that introduces randomness and bidirectional power flows. Another transformative aspect is the increasing penetration of various smart-meter technologies. Inexpensive measurement devices can be placed at practically any component of the grid. Using model data reflecting smart-meter measurements, we propose a two-stage procedure for detecting a fault in a regional power grid. In the first stage, a fault is detected in real time. In the second stage, the faulted line is identified with a negligible delay. The approach uses only the voltage modulus measured at buses (nodes of the grid) as the input. Our method does not require prior knowledge of the fault type. The method is fully implemented in  R. Pseudo code and complete mathematical formulas are provided

MACHINE LEARNING-BASED FRAMEWORK FOR REMEDIAL CONTROL ACTION PREDICTION USING WIDE-AREA MEASUREMENTS IN INTERCONNECTED POWER SYSTEMS

Growing demand for power systems, economic, and environmental issues, lead to power systems operating close to their stability margin. Power systems are always exposed to disturbances, leading to either instability or cascading outages and blackouts in the worst cases. Although numerous methods have been proposed since 1920 to prevent disturbances, instability and blackout still exist. Among all the instabilities, the fastest occurring one is rotor angle instability or transient instability. Since this instability happens in a fraction of a second, time must be considered in designing remedial control actions (RCAs). Different types of remedial control actions have been proposed in the past, but due to the lack of time consideration in their design, they are not practical for those cases quickly lead to transient instability. Additionally, pre-planned remedial control actions have been employed to overcome time limitations, but they are not able to cover most of the possible scenarios that may occur in the power system. Based on the literature done for this research, predicting remedial control actions has not been implemented yet. This study presents an innovative idea to predict remedial control action schemes that are able to include time limitations and cover possible scenarios properly. There are numerous challenges to consider in performing such a method, such as remedial control actions selection, implementation, practical aspects, and wide-area measurement systems (WAMS). In this study, the different parts of the framework are discussed in detail and implemented. Based on the above discussion, first, an optimized artificial neural network (ANN) is implemented to make a comprehensive framework that can predict a proper remedial control action to prevent cascading outages and blackouts. The different steps of the framework are predicted using this comprehensive algorithm. A micro model strategy has been employed, which builds a model for each line separately. This micro model decreases prediction complexity and increases the prediction accuracies of the modules. The common RCAs, including controlled islanding, load shedding, and generator rejection, are implemented in this research project. To address controlled islanding prediction, in the first step, using voltage data, the stability status was predicted. In the second step, a new method to identify coherent groups of generators was developed, and based on that method; the coherency patterns have been predicted. In the third step, a combination of islanding and load shedding is selected as a control action, and a mixed-integer linear programming (MILP) method is designed to compute islands, the amount of load shedding, and load buses. Since the load shedding prediction has two aspects and it is a very challenging problem, a new concept called the specific set of loads (SSLs) had been proposed to simplify this issue. Finally, the islanding and load shedding patterns are predicted. The framework was tested via the IEEE 39 bus system and 74-bus Nordic power system, and the results show the effectiveness of the framework. To implement generator rejection prediction, the bus voltage data are used to predict the stability status. Next, the critical generators are predicted. Then, using the equal area criterion, the amount of generator rejection for each critical generator is calculated, and the patterns are extracted. Finally, the number of generator rejections is predicted using the dataset and designed ANN. The performance of the generator rejection prediction framework is tested via the IEEE 9-bus system and 74-Bus Nordic power network

Protection of Active Distribution Networks and Their Cyber Physical Infrastructure

Today’s Smart Grid constitutes several smaller interconnected microgrids. However, the integration of converter-interfaced distributed generation (DG) in microgrids has raised several issues such as the fact that fault currents in these systems in islanded mode are way less than those in grid connected microgrids. Therefore, microgrid protection schemes require a fast, reliable and robust communication system, with backup, to automatically adjust relay settings for the appropriate current levels according to the microgrid’s operation mode. However, risks of communication link failures, cyber security threats and the high cost involved to avoid them are major challenges for the implementation of an economic adaptive protection scheme. This dissertation proposes an adaptive protection scheme for AC microgrids which is capable of surviving communication failures. The contribution is the use of an energy storage system as the main contributor to fault currents in the microgrid’s islanded mode when the communication link fails to detect the shift to the islanded mode. The design of an autonomous control algorithm for the energy storage’s AC/DC converter capable of operating when the microgrid is in both grid-connected and islanded mode. Utilizing a single mode of operation for the converter will eliminate the reliance on communicated control command signals to shift the controller between different modes. Also, the ability of the overall system to keep stable voltage and frequency levels during extreme cases such as the occurrence of a fault during a peak pulse load period. The results of the proposed protection scheme showed that the energy storage -inverter system is able to contribute enough fault current for a sufficient duration to cause the system protection devices to clear the fault in the event of communication loss. The proposed method was investigated under different fault types and showed excellent results of the proposed protection scheme. In addition, it was demonstrated in a case study that, whenever possible, the temporary disconnection of the pulse load during the fault period will allow the utilization of smaller energy storage device capacity to feed fault currents and thus reduce the overall expenditures. Also, in this dissertation we proposed a hybrid hardware-software co-simulation platform capable of modeling the relation between the cyber and physical parts to provide a protection scheme for the microgrid. The microgrid was simulated on MATLAB/Simulink SimPowerSystems to model the physical system dynamics, whereas all control logic was implemented on embedded microcontrollers communicating over a real network. This work suggested a protection methodology utilizing contemporary communication technologies between multi-agents to protect the microgrid