Cyber-secure dynamic monitoring and decision systems
Systems and methods for detecting cyber attacks of subsystems include an interface of the subsystem that provides power exchange. A processor may be configured to calculate an interaction variable from a function of one or more internal states of the subsystem. A comparator circuit is coupled to receive the output signal and the interaction variable, to determine a difference between at least one characteristic of the power signal and at least one characteristic of the interaction variable. A cyber-attack identification module is configured to identify the presence of a cyber-attack targeting the system based on the difference between the at least one characteristic of the power signal and the at least one characteristic of the interaction variable.
1 . A system comprising:
an external interface at which a power output signal is provided;
a controller configured to determine an interaction variable as a function of one or more internal states of the system;
a comparator circuit coupled to receive the power output signal from the external interface and the interaction variable from the controller, to determine a difference between at least one characteristic of the power output signal from the external interface and at least one characteristic of the interaction variable from the controller; and
one or more processors configured to receive the determined difference and in response thereto to determine whether a cyber-attack is present.
2 . The system of claim 1 wherein the system is a microgrid.
3 . The system of claim 2 wherein the power output signal is a power output signal of the microgrid.
4 . The system of claim 2 wherein the microgrid is a hierarchical microgrid.
5 . The system of claim 1 wherein the interaction variable is calculated as a function that includes a rate of change of reactive power of the power output signal.
6 . The system of claim 1 wherein the internal states comprise:
an amount of power generated by the system;
an amount of power provided as an output of the system;
an amount of power received from other systems;
a change in a power level of the system;
or any combination thereof.
7 . The system of claim 1 wherein the one or more processors are configured to calculate a threshold value and to compare the determined difference to the threshold value to determine whether the cyber-attack is present.
8 . The system of claim 7 wherein the threshold value is calculated based upon historical data associated with the system.
9 . The system of claim 1 wherein the system further comprises one or more power source elements coupled to the controller and one or more load elements coupled to the controller.
10 . The system of claim 9 comprising at least one measurement circuit coupled to the one or more power source elements and/or the one or more load elements, wherein the at least one measurement circuit is configured to measure a state of the one or more power source elements and/or the one or more load elements.
11 . A method of detecting a cyber-attack on a system, the method comprising:
providing, by the system, a power output signal from an external interface;
measuring one or more internal states of the system;
determining, by a controller, an interaction variable as a function of one or more internal states of the system;
determining, by a comparator circuit coupled to receive the power output signal from the external interface and the interaction variable from the controller, a difference between at least one characteristic of the power output signal from the external interface and at least one characteristic of the interaction variable from the controller; and
determining, by one or more processors, whether a cyber-attack is present based on the determined difference.
12 . The method of claim 11 wherein the system is a microgrid.
13 . The method of claim 12 wherein the power output signal is a power output signal of the microgrid.
14 . The method of claim 12 wherein the microgrid is a hierarchical microgrid.
15 . The method of claim 11 wherein the interaction variable is calculated as a function that includes a rate of change of reactive power of the power output signal.
16 . The method of claim 11 wherein the internal states comprise:
an amount of power generated by the system;
an amount of power provided as an output of the system;
an amount of power received from other systems;
a change in a power level of the system;
or any combination thereof.
17 . The method of claim 11 further comprising calculating, by the one or more processors, a threshold value, and comparing the determined difference to the threshold value to determine whether the cyber-attack is present.
18 . The method of claim 17 wherein calculating the threshold value further comprises analyzing historical data associated with the system.
19 . The method of claim 11 wherein the system further comprises one or more power source elements coupled to the controller and one or more load elements coupled to the controller.
20 . The method of claim 19 further comprising measuring, by at least one measurement circuit coupled to the one or more power source elements and/or the one or more load elements, a state of the one or more power source elements and/or the one or more load elements.