Isolating Signatures of Cyberattacks under Stressed Grid Conditions

TL;DR

This paper introduces a Koopman mode-based algorithm for real-time detection and visualization of cyberattack signatures in power grids, even during stress conditions caused by physical disturbances.

Contribution

It presents a novel online framework that captures both natural and malicious oscillation modes in power network measurements under stress conditions.

Findings

Successfully identified attack signatures in IEEE 68-bus system

Enabled comparison of different cyberattack impacts

Demonstrated effectiveness during grid stress scenarios

Abstract

In a controlled cyber-physical network, such as a power grid, any malicious data injection in the sensor measurements can lead to widespread impact due to the actions of the closed-loop controllers. While fast identification of the attack signatures is imperative for reliable operations, it is challenging to do so in a large dynamical network with tightly coupled nodes. A particularly challenging scenario arises when the cyberattacks are strategically launched during a grid stress condition, caused by non-malicious physical disturbances. In this work, we propose an algorithmic framework -- based on Koopman mode (KM) decomposition -- for online identification and visualization of the cyberattack signatures in streaming time-series measurements from a power network. The KMs are capable of capturing the spatial embedding of both natural and anomalous modes of oscillations in the sensor measurements and thus revealing the specific influences of cyberattacks, even under existing non-malicious grid stress events. Most importantly, it enables us to quantitatively compare the outcomes of different potential cyberattacks injected by an attacker. The performance of the proposed algorithmic framework is illustrated on the IEEE 68-bus test system using synthetic attack scenarios. Such knowledge regarding the detection of various cyberattacks will enable us to devise appropriate diagnostic scheme while considering varied constraints arising from different attacks.