Data-Driven Measurement Tampering Detection Considering Spatial-Temporal Correlations

Cyber-attackers could stealthily interfere with the normal operation of power systems by maliciously tampering the measurements transmitted from field devices to control centers. Although some data-driven methods capable of identifying abnormal measurements have been proposed, there are some remaining shortcomings such as low accuracy and slow convergence rate. This paper devises a novel framework by combining convolutional neural networks (CNN) and long-short-term memory (LSTM) networks for detecting tampering attacks based on recognizing spatial-temporal correlations between measurements. Besides, optimization such as the attention mechanism, Dropout layers and SVM are applied to improve the performance of the proposed framework. This paper also introduces how to implement the proposed framework in practical cyber-physical systems and expounds the synergistic relationships between the data-driven detector and the traditional bad data detection module. Case studies prove that the proposed framework has better learning performance than existing ones.

I. Introduction

The robust smart grid (RSG) and the ubiquitous electric Internet of Things (UEIoT) are expected as the architectural backbone of the next generation of electric power systems in China. RSG provides reliable physical channels for energy flows, whereas information from various sectors, including power generation, transmission, and end users, are shared through UEIoT to realize more economical energy dispatching. The intersection of the underlying technology of the RSG and the UEIoT is the cyber-physical system (CPS). Energy flows and information flows are tightly coupled with each other in CPS to facilitate intelligent system monitoring and control. However, it also has a side effect, i.e., making CPS more susceptible to cyber-attacks [1]. The explosion of the Stuxnet virus in 2010 shocked the global industry, confirming that physical isolation cannot wholly guarantee the cybersecurity of CPS [2]. In 2015, the first large-scale blackout directly caused by cyber-attacks happened in Ukraine. This incident indicates the existence of potential cyber vulnerabilities in current power systems, which draws more attention to power system cybersecurity issues [3].