Detection of false data injection attacks in power systems using multiplex invariant networks and domain knowledge
A computer-implemented method, system, and computer program product are provided for anomaly detection in a power system. The method includes receiving, by a processor-device, a plurality of measurements from a plurality of meters throughout the power system. The method also includes generating, by the processor-device, temporal causal networks based on pair-wise relationships between the plurality of measurements from the plurality of meters over time. The method additionally includes determining, by the processor-device, invariant relationships for the plurality of meters between the temporal causal networks. The method further includes predicting, by the processor-device, an anomaly from the invariant relationships for the plurality of meters with a residual anomaly threshold. The method also includes disabling one of the plurality of meters that originated the anomaly.
1. A computer-implemented method for anomaly detection in a power system, the method comprising:
receiving, by a processor-device, a plurality of measurements from a plurality of meters throughout the power system;
generating, by the processor-device, temporal causal networks based on pair-wise relationships between the plurality of measurements from the plurality of meters over time;
determining, by the processor-device, invariant relationships for the plurality of meters between the temporal causal networks;
predicting, by the processor-device, an anomaly from the invariant relationships for the plurality of meters with a residual anomaly threshold; and
disabling one of the plurality of meters that originated the anomaly.
2. The computer-implemented method as recited in claim 1 , wherein disabling includes shutting down the one of the plurality of meters or isolating a power system node connected to the one of the plurality of meters.
3. The computer-implemented method as recited in claim 2 , wherein the power system node can be selected from the group consisting of a generation center, a generation center sub-system, a transformer, a transmission line, and a transmission tower.
4. The computer-implemented method as recited in claim 1 , wherein generating includes generating the temporal causal networks for active power flowing to each of the plurality of meters, active power flowing from each of the plurality of meters, reactive power flowing to each of the plurality of meters, and reactive power flowing from each of the plurality of meters.
5. The computer-implemented method as recited in claim 1 , wherein generating includes incorporating non-linear system states through a deep robust autoencoder mechanism.
6. The computer-implemented method as recited in claim 1 , wherein determining includes employing Kalman filters on the temporal causal networks.
7. The computer-implemented method as recited in claim 6 , wherein employing includes modeling a state of each of the plurality of meters over time.
8. The computer-implemented method as recited in claim 1 , wherein predicting includes augmenting the residual anomaly threshold with an adaptive component.
9. The computer-implemented method as recited in claim 1 , wherein generating includes employing a regression-based method for uncovering temporal causality.
10. A computer program product for anomaly detection in a power system, the computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method comprising:
receiving, by a processor-device, a plurality of measurements from a plurality of meters throughout the power system;
generating, by the processor-device, temporal causal networks based on pair-wise relationships between the plurality of measurements from the plurality of meters over time;
determining, by the processor-device, invariant relationships for the plurality of meters between the temporal causal networks;
predicting, by the processor-device, an anomaly from the invariant relationships for the plurality of meters with a residual anomaly threshold; and
disabling one of the plurality of meters that originated the anomaly.
11. The computer-implemented method as recited in claim 10 , wherein generating includes incorporating non-linear system states through a deep robust autoencoder mechanism.
12. An energy management system with anomaly detection, the energy management system comprising:
a processing system including a processor and memory coupled to the processor, the processing system programmed to:
receive a plurality of measurements from a plurality of meters throughout the power system;
generate temporal causal networks based on pair-wise relationships between the plurality of measurements from the plurality of meters over time;
determine invariant relationships for the plurality of meters between the temporal causal networks;
predict an anomaly from the invariant relationships for the plurality of meters with a residual anomaly threshold; and
disable one of the plurality of meters that originated the anomaly.
13. The energy management system as recited in claim 12 , wherein the processing system is further programmed to shut down the one of the plurality of meters or isolate a power system node connected to the one of the plurality of meters.
14. The energy management system as recited in claim 13 , wherein the power system node can be selected from the group consisting of a generation center, a generation center sub-system, a transformer, a transmission line, and a transmission tower.
15. The energy management system as recited in claim 12 , wherein the processing system is further programmed to generate the temporal causal networks for active power flowing to each of the plurality of meters, active power flowing from each of the plurality of meters, reactive power flowing to each of the plurality of meters, and reactive power flowing from each of the plurality of meters.
16. The energy management system as recited in claim 12 , wherein the processing system is further programmed to incorporate non-linear system states through a deep robust autoencoder mechanism.
17. The energy management system as recited in claim 12 , wherein the processing system is further programmed to employ Kalman filters on the temporal causal networks.
18. The energy management system as recited in claim 17 , wherein the processing system is further programmed to model a state of each of the plurality of meters over time.
19. The energy management system as recited in claim 12 , wherein the processing system is further programmed to augment the residual anomaly threshold with an adaptive component.
20. The energy management system as recited in claim 12 , wherein the processing system is further programmed to employ a regression-based method for uncovering temporal causality.