Cyber Physical Security Analytics for Anomalies in Transmission Protection Systems

Protection devices are considered to be the most critical components responsible for protecting the electrical grid. Due to recent technological advancements in the electrical grid, digitalization has played an influential role in integration of digital devices in protection systems. Incorporation of digital devices in protection systems has made Transmission Protection System more prone to vulnerabilities and cyber-attacks. A cyber attack exploiting protection devices aims to disrupt the normal operations by raising multiple false alarms on a large scale creating conflicting and confusing observation in the control center. Finding exact root cause(s) for the multiple alarms is important to solve this problem. The research presented in this paper imitates a cyber attack on the IEEE test system with industrial hardware relays in the loop, by manipulating the setting/logic design of protection devices in the system creating conflicting alarms in the control center. This paper presents a novel data analytics based approach combining signature-based method for detecting an intrusion in the cyber system and a deep learning algorithm for detecting a mal-operation in the physical system. Data gathered from the physical system through sensors such as Phasor Measurement Units (PMUs) and data acquired from cyber system through relay are analyzed by data analytics approach finding the root-cause of the observed events. The results of data analytics are further validated using the log data from protection devices.