Real-time Intrusion Detection in Power System Operations

Increasing power system security is crucial to the future of the electric power grid. In this paper, we define a new class of cyberattacks to power systems-malicious modification of network data stored in an accessible database. Grounded in multivariate statistical process control, our approach to intrusion detection ensures data integrity in power system operations. We develop an algorithm that monitors power flow results and detects anomalies in the input values that could have been modified by cyberattacks. Our algorithm uses principal component analysis to separate power flow variability into regular and irregular subspaces. Analysis of the information in the irregular subspace determines whether the power system data has been compromised. We verify the efficacy of the algorithm using both the IEEE 24-bus and 118-bus reliability test systems. The results show that the developed algorithm is a promising enhancement to data security procedures in a control center.