Cyber Physical Security Analytics for Anomalies in Transmission Protection Systems

Protection devices are considered to be the most critical components responsible for protecting the electrical grid. Due to recent technological advancements in the electrical grid, digitalization has played an influential role in integration of digital devices in protection systems. Incorporation of digital devices in protection systems has made Transmission Protection System more prone to vulnerabilities and cyber-attacks. A cyber attack exploiting protection devices aims to disrupt the normal operations by raising multiple false alarms on a large scale creating conflicting and confusing observation in the control center. Finding exact root cause(s) for the multiple alarms is important to solve this problem. The research presented in this paper imitates a cyber attack on the IEEE test system with industrial hardware relays in the loop, by manipulating the setting/logic design of protection devices in the system creating conflicting alarms in the control center. This paper presents a novel data analytics based approach combining signature-based method for detecting an intrusion in the cyber system and a deep learning algorithm for detecting a mal-operation in the physical system. Data gathered from the physical system through sensors such as Phasor Measurement Units (PMUs) and data acquired from cyber system through relay are analyzed by data analytics approach finding the root-cause of the observed events. The results of data analytics are further validated using the log data from protection devices.

I. Introduction

A protection system is a critical component of the power grid which isolates the faulty segment from non-faulty segment, as soon as possible during a fault in the power grid. Malfunctions or failures of the protection devices in a power grid can lead to the isolation of some part of the non-faulty segment along with the faulty segment of the system. Protection system mal-operation has been ranked number one concern by the North American Electric Reliability Corporation (NERC) to cause power blackouts [1]. Diagnosis of the root cause causing failures in protection system is very important to restore the system to the normal operating condition. A component in protection system mal-operates when it either fails to function as designed, operates unintentionally or outside of its expected zone of protection. Such mal-operations could be due to physical failures or cyber-induced reasons. With the increasing automation and digitalization in the power grid, there are higher risks of cyber anomaly induced protection system mal-operations and failures.