Early detection of cyber-attacks is crucial for a safe and reliable operation of the smart grid. In the literature, outlier detection schemes making sample-by-sample decisions and online detection schemes requiring perfect attack models have been proposed. In this paper, we formulate the online attack anomaly detection problem as a partially observable Markov decision process (POMDP) problem and propose a universal robust online detection algorithm using the framework of model-free reinforcement learning (RL) for POMDPs. Numerical studies illustrate the effectiveness of the proposed RL-based algorithm in timely and accurate detection of cyber-attacks targeting the smart grid.
Outlier detection schemes such as the Euclidean detector @cite_3 and the cosine-similarity metric based detector @cite_15 are universal as they do not require any attack model. They mainly compute a dissimilarity metric between actual meter measurements and predicted measurements (by the Kalman filter) and declare an attack anomaly if the amount of dissimilarity exceeds a certain predefined threshold. However, such detectors do not consider temporal relation between attacked anomalous measurements and make sample-by-sample decisions. Hence, they are unable to distinguish instantaneous high-level random system noise from long-term (persistent) anomalies caused, e.g., by an unfriendly intervention to the system. Hence, compared to the outlier detection schemes, more reliable universal attack detection schemes are needed.
@cite_15 @cite_3
2091497071 2039984414
The transformation of traditional energy networks to smart grids can assist in revolutionizing the energy industry in terms of reliability, performance and manageability. However, increased connectivity of power grid assets for bidirectional communications presents severe security vulnerabilities. In this letter, we investigate Chi-square detector and cosine similarity matching approaches for attack detection in smart grids where Kalman filter estimation is used to measure any deviation from actual measurements. The cosine similarity matching approach is found to be robust for detecting false data injection attacks as well as other attacks in the smart grids. Once the attack is detected, system can take preventive action and alarm the manager to take preventative action to limit the risk. Numerical results obtained from simulations corroborate our theoretical analysis. By exploiting the communication infrastructure among the sensors, actuators, and control systems, attackers may compromise the security of smart-grid systems, with techniques such as denial-of-service (DoS) attack, random attack, and data-injection attack. In this paper, we present a mathematical model of the system to study these pitfalls and propose a robust security framework for the smart grid. Our framework adopts the Kalman filter to estimate the variables of a wide range of state processes in the model. The estimates from the Kalman filter and the system readings are then fed into the @math -detector or the proposed Euclidean detector. The @math -detector is a proven effective exploratory method used with the Kalman filter for the measurement of the relationship between dependent variables and a series of predictor variables. The @math -detector can detect system faults attacks, such as DoS attack, short-term, and long-term random attacks. However, the studies show that the @math -detector is unable to detect the statistically derived false data-injection attack. To overcome this limitation, we prove that the Euclidean detector can effectively detect such a sophisticated injection attack.