An Online Approach to Cyberattack Detection and Localization in Smart Grid

TL;DR

This paper presents an online detection algorithm for identifying and localizing covert cyberattacks in smart grids, improving detection speed and accuracy over traditional methods by leveraging sparsity in state-estimation residuals.

Contribution

The paper introduces a novel online detection and localization method for cyberattacks in smart grids using sparse regression, validated through extensive numerical simulations.

Findings

Outperforms conventional detection methods in detection delay

Achieves higher localization accuracy

Effective on both linear and nonlinear system models

Abstract

Complex interconnections between information technology and digital control systems have significantly increased cybersecurity vulnerabilities in smart grids. Cyberattacks involving data integrity can be very disruptive because of their potential to compromise physical control by manipulating measurement data. This is especially true in large and complex electric networks that often rely on traditional intrusion detection systems focused on monitoring network traffic. In this paper, we develop an online detection algorithm to detect and localize covert attacks on smart grids. Using a network system model, we develop a theoretical framework by characterizing a covert attack on a generator bus in the network as sparse features in the state-estimation residuals. We leverage such sparsity via a regularized linear regression method to detect and localize covert attacks based on the regression coefficients. We conduct a comprehensive numerical study on both linear and nonlinear system models to validate our proposed method. The results show that our method outperforms conventional methods in both detection delay and localization accuracy.