Method and apparatus for detecting cyber attacks on an alternating current power grid
View Patent ↗A method and apparatus for detecting cyber attacks on remotely-operable elements of an alternating current distribution grid. Two state estimates of the distribution grid are prepared, one of which uses micro-synchrophasors. A difference between the two state estimates indicates a possible cyber attack.
1. A method for detecting a possible cyber attack on an alternating-current power distribution grid, wherein the alternating-current power distribution grid excluding high voltage transmission lines, and the alternating-current power distribution grid having a plurality of remotely-operable elements, each remotely-operable element having a present state, the method comprising the following steps:
periodically obtaining a first set of information about the present state of each remotely-operable element through a communication network or from instructions sent to the each remotely-operable element through a communication network, or both;
employing the first set of information obtained about the present state of each remotely-operable element to prepare a first state estimation of the alternating current power distribution grid;
periodically, but contemporaneously with obtaining the first set of information employed to prepare the first state estimation, making a plurality of micro-synchrophasor measurements at not less than two locations on the alternating current power distribution grid, wherein the micro-synchrophasor measurements being made with an angular resolution of ±0.015° or better;
using the micro-synchrophasor measurements to calculate a plurality of synchrophasor parameter values;
using the synchrophasor parameter values to calculate a second state estimation of the alternating current power distribution grid, wherein the second state estimation being contemporaneous with the first state estimation;
comparing the first state estimation to the second state estimation, and detecting a possible cyber attack if the first state estimation and the contemporaneous second state estimation are not equal.
2. The method of claim 1 , in which the step of comparing the first state estimation to the contemporaneous second state estimation includes an evaluation of confidence in the accuracy of the first state estimation, an evaluation of confidence in the accuracy of the contemporaneous second state estimation, or both, and uses the evaluation of confidence in accuracy to determine if there is sufficient information to conclude whether the first state estimation and the second state estimation are not equal.
3. An apparatus for detecting a possible cyber attack on an alternating-current power distribution grid, wherein the alternating-current power distribution grid excluding high-voltage transmission lines, and the alternating-current power distribution grid having a plurality remotely-operable elements, each of remotely-operable element having a present state, each such remotely-operable element capable of receiving commands to change its state, or each of remotely-operable element capable of reporting its present state, or both, the apparatus comprising the following elements, such elements not necessarily co-located:
a first state estimator element that periodically calculates a first state estimate of the alternating-current power distribution grid based on the commands to, and the reports from, the remotely operable elements;
a plurality, but not less than two, micro-synchrophasor instruments periodically making synchrophasor measurements on the alternating-current power distribution grid, each of micro-synchrophasor instrument capable of making micro-synchrophasor measurements with an angular resolution of ±0.015° or better, each of micro-synchrophasor instrument capable of reporting its synchrophasor measurements to a Phasor Data Concentrator element, such Phasor Data Concentrator element capable of calculating a plurality of synchrophasor and power flow parameters;
a second state estimator element that calculates a second state estimate, contemporaneous with the first state estimate, of the alternating-current power distribution grid based on the plurality of synchrophasor and power flow parameters;
a state estimate comparison element that compares the first state estimate with the contemporaneous second state estimate, and if the state estimates are not equal the state estimate comparison element reports that the alternating-current power distribution grid is under a possible cyber attack; wherein the first state estimator, the second state estimator and the state estimate comparison elements are executed inside the hardware apparatus.
4. The apparatus of claim 3 in which the state estimate comparison element includes an evaluation of confidence in the accuracy of the first state estimate, the accuracy of the second state estimate, or both, and uses the evaluation of confidence in accuracy to determine if there is sufficient information to conclude whether the first state estimate and the second state estimate are not equal.