Power System Anomaly Detection and Classification Utilizing WLS-EKF State Estimation and Machine Learning

TL;DR

This paper introduces a hybrid analytical and machine learning algorithm for detecting, classifying, and locating anomalies in power system state estimation, effectively distinguishing between different anomaly types including false data attacks.

Contribution

It presents a novel two-stage algorithm combining chi-squared testing and ML classification that is adaptable to network topology changes, improving anomaly discrimination accuracy.

Findings

High detection accuracy on IEEE 14 bus system

Effective discrimination between load changes and false data attacks

Algorithm remains robust after network topology modifications

Abstract

Power system state estimation is being faced with different types of anomalies. These might include bad data caused by gross measurement errors or communication system failures. Sudden changes in load or generation can be considered as anomaly depending on the implemented state estimation method. Additionally, considering power grid as a cyber physical system, state estimation becomes vulnerable to false data injection attacks. The existing methods for anomaly classification cannot accurately classify (discriminate between) the above mentioned three types of anomalies, especially when it comes to discrimination between sudden load changes and false data injection attacks. This paper presents a new algorithm for detecting anomaly presence, classifying the anomaly type and identifying the origin of the anomaly, i.e., measurements that contain gross errors in case of bad data, or buses associated with loads experiencing a sudden change, or state variables targeted by false data injection attack. The algorithm combines analytical and machine learning (ML) approaches. The first stage exploits an analytical approach to detect anomaly presence by combining $\chi^2$-test and anomaly detection index. The second stage utilizes ML for classification of anomaly type and identification of its origin, with particular reference to discrimination between sudden load changes and false data injection attacks. The proposed ML based method is trained to be independent of the network configuration which eliminates retraining of the algorithm after network topology changes. The results obtained by implementing the proposed algorithm on IEEE 14 bus test system demonstrate the accuracy and effectiveness of the proposed algorithm.