Professional Documents
Culture Documents
in Power Grid
Mohammad Sabouri Sara Siamak Maryam Dehghani
School of Electrical and Computer School of Electrical and Computer School of Electrical and Computer
Engineering Engineering Engineering
Shiraz University Shiraz University Shiraz University
Shiraz, Iran Shiraz, Iran Shiraz, Iran
m.sabouri@shirazu.ac.ir s.siyamak@shirazu.ac.ir mdehghani@shirazu.ac.ir
Abstract—Due to the integration of wireless technology in counterfeiting attacks and attack reconstruction is offered. In
power systems, the issue of cybersecurity becomes very critical. another study, two methods are presented to compare the
Cyberattacks mainly cause changes in power system information received from GPS receiver antennas with a
measurement data like GPS spoofing attack (GSA), which specific pattern for attack detection [3]. In [4], using an
modifies the phase angle of Phasor Measurement Units (PMUs) observer, FDI attacks are detected, and the measurement data
data. The GSA may lead to disruption in monitoring and is corrected before being fed to the control center of the power
protection systems. In this paper, a neural network GPS system. In [5], a static model is developed to detect
spoofing detection (NNGSD) with employing PMU data from synchrophasor-based system states while a GSA is happened.
the dynamic power system is proposed to detect GSAs. Due to
In [6], an algorithm of integrating phasor measurement
the use of an artificial intelligence-based kernel, the proposed
structure can be used in various power grid conditions, such as
methods and state estimation methods to detect attacks is
2021 11th Smart Grid Conference (SGC) | 978-1-6654-0165-4/21/$31.00 ©2021 IEEE | DOI: 10.1109/SGC54087.2021.9664217
load changes in the grid, in the presence of noise and multi-GSA presented. Moreover, in [7], a correction system for states
on PMUs. NNGSD is applied to the standard IEEE 14-buses based on comparison with the measured states are presented.
power system. Numerical results show the real-time In model-based approaches, the main focus is on applying
performance of the proposed detection method in different a system model to estimate the states or phase angles of the
conditions. system [8], while in learning-based methods, data is of
paramount importance [9]–[13]. In [14], using deep learning
Keywords—Attack detection, GPS spoofing, Neural network.
methods, FDI attacks are studied, and the behavioral
characteristics of the power system against FDI attacks are
extracted from past system data that utilize these features to
I. INTRODUCTION detect attacks. [15] uses machine learning algorithms to
The reliability of the smart grid depends on the proper classify secure and under FDI attacks measurements. In [16],
performance of the Wide Area Monitoring System (WAMS) a method is presented to detect anomalies based on FDI
[1]. The data collected by WAMS provide real-time status of attacks using an observer consisting of two parts, Luenberger,
the system. The power system is vulnerable to cyberattacks and a neural network. In addition to these researches, some
due to its telecommunication devices like PMU, which is used articles have used both model-based and data-based methods
as a meter in the WAMS system. PMUs are vulnerable to false to counter cyber-attacks in the power grid. In [17], using static
data injection (FDI) and GPS spoofing attacks [2]. The state estimation and clustering algorithms, FDI attacks are
spoofing attack is due to the receiving GPS-like signals. These detected and localized and the attacked measurements are
attacks can affect PMU measurement data and thus, power corrected.
system state estimation, stability and analysis results. Changes In this paper, an artificial neural network (ANN)-based
in system states can disrupt network performance and cause approach is proposed to detect GPS spoofing attacks using
physical and economic damages to the grid. It is more information measured by the PMU. Unlike methods that
challenging to detect GPS spoofing if the attack is carried out require updating their detectors, the proposed method can only
skillfully. perform one-time basic training of attack detection operations
Recent research in the field of detecting PMU attacks in with less complexity and computation time. The performance
power systems reveals two distinct approaches. These two of this method is such that it can be used even in various
categories can be divided into the following topics. 1-Model- conditions such as network load changes and in the presence
dependent approaches 2- Learning-based approaches. of noise. Moreover, the provided detector has the capability of
detecting GPS spoofing attacks under different conditions and
Given the importance of GPS spoofing attacks that lead to on several PMUs, despite the simplicity of the structure. The
power system errors, it has always been a matter of idea is based on training an ANN by a variety of attack models
significance to detect attacks as fast as possible which leads to using different affected datasets of attacks.
a lot of research in this area. Among the model-dependent
investigations, the following can be mentioned: In [2], an The structure of this article is organized as follows.
approach to investigate the vulnerability of PMUs in Section II introduces the basic concepts related to the structure
Authorized licensed use limited to: National University Fast. Downloaded on August 25,2022 at 13:10:07 UTC from IEEE Xplore. Restrictions apply.
of a power grid as well as basic information on ANNs. Section weight and activation function, then transfers to the next layer
III discusses the approach used to detect GPS attacks. In [20] as follows:
Section IV, the simulation results of the proposed method for
#
= !" + $
several attacks are discussed. Finally, the results and
conclusions of this work are discussed in the final section. (3)
the *th column of weight matrix, " is the network bias vector
A. Power System Model respectively. is the th row of neural network input, is
+ , = 1…
and it does not affect the absolute of the signals [22]. The
relation between the spoofed measurement data and correct
data is defined by (4) and (5) [23]:
= + + (2) =| |- + . + /
(4)
01223
= 4 01223 4 - +5. + / + /01223 6
=| | - +5. + / + /01223 6
where and represent the transfer matrices of each (5)
Authorized licensed use limited to: National University Fast. Downloaded on August 25,2022 at 13:10:07 UTC from IEEE Xplore. Restrictions apply.
B. Neural Network Unit the non-occurrence of an attack. By determining the matrix Q
and (2), the neural network is trained and the matrices 8 ? and
The neural network used in the NNGSD structure is a and the inputs and the outputs of the training data using (1)
= 7" + 8 9;
and attack localization blocks. The objective of normalizer
function block is to normalize the output of NN and to
facilitate the attack locating process. The following equation
0= #
at the th sample time and *th output:
is used to calculate the output vector of the normalizer block
<
= < 7"< + 8< ;
1 S ≥_
⋮ ]5S 6 = S −_ =`
0 S <_
(12)
0AB= #
where . is a step function and _ is the normalization
(6)
?
= ? 7"? + 8? ?@
;
threshold coefficient which in addition to increasing the
⋮
accuracy of the neural network output, improves the output of
= = 7" + 8 @
; an input vector. In this unit, if some elements of the input
vector are one, the associated PMUs are reported as being
attacked. The zero elements reveal the security of the related
where
⋯
PMUs. Finally, the Mux block tags the time data to the output
0AB=
8? = D ⋮ ⋱ ⋮
data of attack location block.
G
⋯
(7)
0A 0A 0AB=
IV. SIMULATION RESULTS
In this section, the proposed method in section III is
⋯
implemented and simulated in MATLAB software for the
#
9=D ⋮ ⋱ ⋮ G
standard IEEE-14 bus power system with 5 generators. The
⋯
(8) simulation and verification process of the spoof detector is as
& && follows.
-H = I-J = , -< , … , - , - = )K
The neural network construction applied in the spoofing
@ (9) detector is defined based on the MLP neural network in (6-
Q=R 4S T
In the neural network training process, to examine the
⋯ S ⋯ S#
behavior of the network with the desired structure against
⎡ ⋮ ⋮ ⎤⎥
X
⋱ ⋮ ⋮ ⋱
changes in parameters, various simulations are done. In other
⎢
⋯ S? ⋯ S?Y ⎥
words, to examine the sensitivity of the neural network by
=⎢ ? X?
⎢ ⋮ ⋮ ⎥⎥
(11) changing these parameters, several tests are statistically
⎢ ⋱ ⋮ ⋮ ⋱
reviewed. The statistical result of the accuracy of the training
⎣ X ⋯ S X ⋯ S X# ⎦
performed in the learning process is shown in Fig. 2. Based on
X# the results shown in Fig. 2, the change in neural network
where + is the number of samples. Each element of
accuracy under the training parameters’ variations, are very
Authorized licensed use limited to: National University Fast. Downloaded on August 25,2022 at 13:10:07 UTC from IEEE Xplore. Restrictions apply.
By forming training matrices, neural network inputs and
outputs are integrated into MATLAB training process. At the
end of the training process, the receiver operating
characteristic (ROC) analysis is shown in Fig. 3. and the test
results are reviewed.
Authorized licensed use limited to: National University Fast. Downloaded on August 25,2022 at 13:10:07 UTC from IEEE Xplore. Restrictions apply.
Fig. 9. The output of NNGSD with spoofed measurements in the presence
Fig. 6. Detection of multi GSA on PMUs in the presence of noise using NN. of noise and load changing.
Authorized licensed use limited to: National University Fast. Downloaded on August 25,2022 at 13:10:07 UTC from IEEE Xplore. Restrictions apply.
Transactions on Smart Grid, vol. 9, no. 5, pp. 4538–4546, 2018, doi: [15] M. Ozay, I. Esnaola, F. T. Yarman Vural, S. R. Kulkarni, and H. V.
10.1109/TSG.2017.2662688. Poor, “Machine Learning Methods for Attack Detection in the Smart
[6] M. Yasinzadeh and M. Akhbari, “Detection of PMU spoofing in power Grid,” IEEE Transactions on Neural Networks and Learning Systems,
grid based on phasor measurement analysis,” IET Generation, vol. 27, no. 8, pp. 1773–1786, 2016, doi:
Transmission and Distribution, vol. 12, no. 9, pp. 1980–1987, 2018, 10.1109/TNNLS.2015.2404803.
doi: 10.1049/iet-gtd.2017.1445. [16] A. Abbaspour, A. Sargolzaei, P. Forouzannezhad, K. K. Yen, and A. I.
[7] Y. Zhang, J. Wang, and J. Liu, “Attack Identification and Correction Sarwat, “Resilient Control Design for Load Frequency Control System
for PMU GPS Spoofing in Unbalanced Distribution Systems,” IEEE under False Data Injection Attacks,” IEEE Transactions on Industrial
Transactions on Smart Grid, 2019, doi: 10.1109/tsg.2019.2937554. Electronics, vol. PP, no. c, pp. 1–1, 2019, doi:
10.1109/tie.2019.2944091.
[8] M. Dehghani, Z. Khalafi, A. Khalili, and A. Sami, “Integrity attack
detection in PMU networks using static state estimation algorithm,” in [17] Z. sadat Khalafi, M. Dehghani, A. Khalili, A. Sami, N. Vafamand, and
2015 IEEE Eindhoven PowerTech, 2015, pp. 1–6. T. Dragicevic, “Intrusion Detection, Measurement Correction, and
Attack Localization of PMU Networks,” IEEE Transactions on
[9] J. Yan, H. He, X. Zhong, and Y. Tang, “Q-Learning-Based Industrial Electronics, 2021.
Vulnerability Analysis of Smart Grid Against Sequential Topology
Attacks,” IEEE Transactions on Information Forensics and Security, [18] H. Varmaziari and M. Dehghani, “Cyber-attack detection system of
vol. 12, no. 1, pp. 200–210, 2017, doi: 10.1109/TIFS.2016.2607701. large-scale power systems using decentralized unknown input
observer,” in 2017 Iranian Conference on Electrical Engineering
[10] K. Hamedani, L. Liu, R. Atat, J. Wu, and Y. Yi, “Reservoir computing (ICEE), 2017, pp. 621–626. doi: 10.1109/IranianCEE.2017.7985114.
meets smart grids: Attack detection using delayed feedback networks,”
IEEE Transactions on Industrial Informatics, vol. 14, no. 2, pp. 734– [19] A. K. Jain, J. Mao, and K. M. Mohiuddin, “Artificial neural networks:
743, 2018, doi: 10.1109/TII.2017.2769106. A tutorial,” Computer, vol. 29, no. 3, pp. 31–44, 1996, doi:
10.1109/2.485891.
[11] S. Mousavian, J. Valenzuela, and J. Wang, “Real-time data reassurance
in electrical power systems based on artificial neural networks,” [20] A. Goodfellow, Ian and Bengio, Yoshua and Courville, Deep Learning.
Electric Power Systems Research, vol. 96, pp. 285–295, 2013, doi: 2016.
10.1016/j.epsr.2012.11.015. [21] J. M. Nazzal, I. M. El-emary, S. a Najim, A. Ahliyya, P. O. Box, and
[12] I. Niazazari and H. Livani, “A PMU-data-driven disruptive event K. S. Arabia, “Multilayer Perceptron Neural Network ( MLPs ) For
classification in distribution systems,” Electric Power Systems Analyzing the Propoerties of Jordan Oil Shale,” World Applied
Research, 2018, doi: 10.1016/j.epsr.2017.12.021. Sciences Journal, vol. 5, no. 5, pp. 546–552, 2008.
[13] J. J. Q. Yu, Y. Hou, and V. O. K. Li, “Online False Data Injection [22] S. Siamak, M. Dehghani, and M. Mohammadi, “Dynamic GPS
Attack Detection with Wavelet Transform and Deep Neural Spoofing Attack Detection, Localization and Measurement Correction
Networks,” IEEE Transactions on Industrial Informatics, vol. 14, no. Exploiting PMU and SCADA,” IEEE Systems Journal, 2020.
7, pp. 3271–3280, 2018, doi: 10.1109/TII.2018.2825243. [23] S. Siamak, M. Dehghani, and M. Mohammadi, “Counteracting GPS
[14] Y. He, G. J. Mendis, and J. Wei, “Real-Time Detection of False Data Spoofing Attack on PMUs by Dynamic State Estimation,” in 2019
Injection Attacks in Smart Grid: A Deep Learning-Based Intelligent Smart Grid Conference (SGC), 2019, pp. 1–5.
Mechanism,” IEEE Transactions on Smart Grid, vol. 8, no. 5, pp.
2505–2516, 2017, doi: 10.1109/TSG.2017.2703842.
Authorized licensed use limited to: National University Fast. Downloaded on August 25,2022 at 13:10:07 UTC from IEEE Xplore. Restrictions apply.