Detecting Anomalies using Overlapping Electrical Measurements in Smart Power Grids

TL;DR

This paper explores how combining overlapping electrical measurements from different systems in smart power grids enhances anomaly detection speed and accuracy, revealing significantly more anomalies than separate analyses.

Contribution

It introduces a novel approach to fuse overlapping electrical measurements for improved anomaly detection in smart power grids, which has not been previously investigated.

Findings

Merging overlapping measurements detects up to 785% more anomalies.

Applying Dynamic Time Warping increases anomaly detection sensitivity.

Overlapping measurements provide a more comprehensive view of system anomalies.

Abstract

As cyber-attacks against critical infrastructure become more frequent, it is increasingly important to be able to rapidly identify and respond to these threats. This work investigates two independent systems with overlapping electrical measurements with the goal to more rapidly identify anomalies. The independent systems include HIST, a SCADA historian, and ION, an automatic meter reading system (AMR). While prior research has explored the benefits of fusing measurements, the possibility of overlapping measurements from an existing electrical system has not been investigated. To that end, we explore the potential benefits of combining overlapping measurements both to improve the speed/accuracy of anomaly detection and to provide additional validation of the collected measurements. In this paper, we show that merging overlapping measurements provide a more holistic picture of the observed systems. By applying Dynamic Time Warping more anomalies were found -- specifically, an average of 349 times more anomalies, when considering anomalies from both overlapping measurements. When merging the overlapping measurements, a percent change of anomalies of up to 785\% can be achieved compared to a non-merge of the data as reflected by experimental results.