Relaxation-based anomaly detection in cyber-physical systems using ensemble kalman filter

• Published in: IET Cyber-Physical Systems: Theory & Applications Vol. 5; no. 1; pp. 49 - 58
• Main Authors: Karimipour, Hadis, Leung, Henry
• Format: Journal Article
• Language: English
• Published: Southampton The Institution of Engineering and Technology 01.03.2020; John Wiley & Sons, Inc; Wiley
• Subjects: 5000 bus system; Accuracy; Anomalies; anomaly detector; burgeoning classes; Chi‐Square detector; cyber-attacks; cyber-physical systems; Decomposition; Denial of service attacks; Electric power systems; ensemble kalman filter; false data injection attack; Kalman filters; Largest Normalised Residual test; online monitoring; Power failures; power grid; power grids; power system security; power system state estimation; power systems; relaxation-based anomaly detection; relaxation-based solution; Research Article; security of data; Sensors; Smart grid; smart grid entities; smart power grids; system blackouts; traditional bad data detection; Chi-Square detector; Largest Normalised Residual test; cyber-attacks; relaxation-based solution; power system state estimation; burgeoning classes; system blackouts; smart power grids; anomaly detector; power grid; ensemble kalman filter; online monitoring; power system security; cyber-physical systems; security of data; smart grid entities; relaxation-based anomaly detection; traditional bad data detection; power systems; power grids; Kalman filters; 5000 bus system; false data injection attack
• ISSN: 2398-3396; 2398-3396
• DOI: 10.1049/iet-cps.2019.0031

As power systems mature into smart grid entities, they face new challenges toward online monitoring and control of the system's behaviour. Burgeoning classes of cyber-attacks are observed which may cause instability of the power grid and system blackouts if not identified. In this study, the authors propose an ensemble Kalman filter based anomaly detector using a relaxation-based solution. Performance of the proposed method is tested with Chi-Square detector and Largest Normalised Residual test. Results of simulations based on real-world data, up to 5000 bus system, demonstrate the effectiveness of the proposed framework over traditional bad data detection in presence of false data injection attack.