|
چکیده
|
Modern Smart Grids incorporate physical power grids and cyber systems, creating a cyberphysical system. Phasor Measurement Units (PMUs) transmit time synchronized measurement data from physical grid to the cyber system. The System Operator (SO) in the cyber layer analyzes the data in both online and offline format and ensure the reliability and security of the grid by sending necessary command back to the PMUs. However, various physical events such as line to ground faults, frequency events or transformer events as well as cyberattacks can cause deviation in measurements received by the SO, which can be termed as bad data. These bad data in turn can cause the SO take wrong restorative/ mitigating strategy. Therefore accurate detection of bad data and identification of correct bad data type is necessary to ensure grid’s safety and optimal performance. In this work we proposed a realtime sequential bad data detection and bad data classification strategy. At first, we have exploited the low rank property of Hankelmatrix to detect the occurance of bad data in realtime. Secondly, we classify the bad data into two categories: physical events and cyberattacks. The algorithm utilizes the difference in low rank approximation error of multi-channel Hankel-matrix before and after random column permutations during physical events. If the cause of bad data is identified as cyberattack, our proposed algorithm proceeds to identify the cause of cyberattack. We have considered two possible cyberattack types: False Data Injection Attack (FDIA) and GPS-Spoofing Attack (GSA). The proposed algorithm observes rank-1 approximation error of singlechannel Hankel matrix containing unwrapped phase angle data to distinguish FDIA from GSA. Finally, the proposed algorithm is implemented in a realtime cyber-physical testbed containing PMU simulator and openECA. Results from the testbed show that by choosing optimum parameters of Hankel-matrix, the bad data can be detected as well as the type of bad data is correctly identified within less than 1 sec. of the occurrence of physical event or cyberattack.
|