Distributed Anomaly Detection in Power Control Areas
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cyber-physical attack detection methods in electric power systems are centralized, making it difficult to distinguish between normal and anomalous conditions, especially when cyber-attacks manipulate measurements, and are vulnerable to attacks designed to undermine these assumptions, requiring more advanced distributed methods for real-time anomaly detection.
Innovation Solution
The method involves dynamic state estimation by decoupling control areas within the electric power system, using voltage phase angles as control inputs to model transitions, allowing for localized anomaly detection without centralized processing, and employing a Kalman filter approach to assess statistical deviations and noise levels, with communication limited to neighboring areas.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If centralized processing is used for anomaly detection in the entire control system, then system-wide consistency is maintained, but detection accuracy decreases when cyber-attacks manipulate measurements
Solution Approach 1:
The patent divides the centralized control system into multiple distributed control areas, each performing local state estimation and anomaly detection independently. This segmentation allows each area to detect anomalies locally without being affected by measurement manipulations in other areas, thereby improving detection accuracy while reducing the complexity of centralized processing.
2Productivity
If distributed methods are used for real-time anomaly detection, then detection speed improves, but communication overhead increases
Solution Approach 1:
Each control area performs local state estimation using only locally available measurements and data from immediately neighboring areas. This local quality approach enables real-time anomaly detection without requiring extensive communication across the entire system, thereby achieving fast detection speed while minimizing communication overhead.
3Ease of operation
If voltage phase angles are treated as control inputs for decoupling dynamics, then localized anomaly detection becomes possible, but system coupling is reduced
Solution Approach 1:
The patent uses voltage phase angles as intermediary control inputs that mediate between the electrical network and the mechanical generator dynamics. By treating phase angles as control inputs, the system can decouple the dynamics of individual control areas, enabling localized anomaly detection while maintaining the essential coupling through the phase angle measurements that are exchanged between neighboring areas.
Data Source
AI summary
Methods and Systems for detecting anomalies in a control area of a control system. Estimating for the control area, a first state from a historical state over a first time period using a model of dynamics, and defining a transition of the first state as a function of control inputs, the first state includes a generator state for each generator, the control inputs include a network state for each bus, a mechanical input to each generator or power consumptions at the buses. Updating estimated first state, by connecting measurements of rotor frequency of each generator and measurements of the network states on the buses with the generator state of each generator, to obtain a second state over a second time period later than the first time period, and detecting anomalies based on a statistic deviation of the second state from its corresponding prediction derived from the first state.