Real-Time Framework for Monitoring Cyber Disruptions in Power Grids

This article presents a novel real-time attack monitoring framework to locate various attacks and identify postattack operating conditions (OCs) using enormous data measured by phasor measurement units (PMU's). Data Mining based online divisive-agglomerative time-series data stream clustering along with data reduction and classification techniques are employed to detect attacks and determine their location by monitoring a minimal number of measuring units. Attack severity and criticality indices are formulated to assess the severity of the attack and identify postattack critical elements in the system to prevent the attack resulting in a large failure. The proposed methodology is tested on IEEE 24 Bus reliability test system and 118 Bus test systems using simulated data considering attacks on different system elements under varying OCs. Additionally, the robustness and real-time applicability of the proposed attack detection methodology is verified, and its strengths and limitations are discussed.