Modeling and Detection of Future Cyber-Enabled DSM Data Attacks using Supervised Learning

TL;DR

This paper develops a novel model to simulate cyber-attacks on demand-side management in smart grids, analyzing attack behaviors and applying supervised learning for detection, revealing that higher DSM participation improves detection but complicates attack mitigation.

Contribution

It introduces a new feedback model for load-price dynamics under cyber-attacks and evaluates supervised learning methods for attack detection in DSM systems.

Findings

Higher DSM participation enhances attack detectability.

Point attacks are the most difficult to detect.

Supervised learning methods perform comparably or better than sequential detectors.

Abstract

Demand-Side Management (DSM) is a vital tool that can be used to ensure power system reliability and stability. In future smart grids, certain portions of a customers load usage could be under automatic control with a cyber-enabled DSM program which selectively schedules loads as a function of electricity prices to improve power balance and grid stability. In such a case, the security of DSM cyberinfrastructure will be critical as advanced metering infrastructure, and communication systems are susceptible to hacking, cyber-attacks. Such attacks, in the form of data injection, can manipulate customer load profiles and cause metering chaos and energy losses in the grid. These attacks are also exacerbated by the feedback mechanism between load management on the consumer side and dynamic price schemes by independent system operators. This work provides a novel methodology for modeling and simulating the nonlinear relationship between load management and real-time pricing. We then investigate the behavior of such a feedback loop under intentional cyber-attacks using our feedback model. We simulate and examine load-price data under different levels of DSM participation with three types of additive attacks: ramp, sudden, and point attacks. We apply change point and supervised learning methods for detection of DSM attacks. Results conclude that while higher levels of DSM participation can exacerbate attacks they also lead to better detection of such attacks. Further analysis of results shows that point attacks are the hardest to detect and supervised learning methods produce results on par or better than sequential detectors.