Fault and Attack Detection and Diagnosis by Analysis of Electrical Waveforms of Power Networks

In recent years, increasing numbers of electronic control units (ECUs), programmable logic controllers (PLCs), and other types of programmable electronics have been deployed into cyber-physical systems. While such progress increased productivity and product quality, it also introduces vulnerabilities to both hardware and software. This study proposes a data-driven approach to monitoring the electric waveforms of the power network of cyber-physical systems for attack and fault detection and diagnosis. In terms of methodology, most studies focus on classification, which only allows for classification of known attacks or faults. While new attacks could be detected, they cannot be properly diagnosed as a new attack would be forced into one of the existing classifiers, thus leading to an incorrect diagnosis. This study proposes using clustering to detect and diagnosis anomalies. Specifically, it proposes using two dimensional unsupervised shapelets (2D u-shapelets) for clustering. U-shapelets are short time series with discriminatory capabilities that can be automatically extracted from a data set. This study is the first of a two phase study to incorporate dynamic clustering with u-shapelets. The advantage of this long term approach allows a system to notify systems users of a new type of attack or fault, which can later be labelled. Thus, the system can learn to identify new anomalies. Extensive evaluations are conducted to study the algorithm performance, such as the performance metrics vs the number of clusters and anomaly types, and the effectiveness for novel adversarial attacks on such systems.