An integrated anomaly detection method for load forecasting data under cyberattacks

As energy delivery systems evolve and become increasingly more reliant on sophisticated forecasting data for efficient operations, it is very likely that they will also become more vulnerable to cybersecurity issues. In particular, very short-term forecasting results will significantly help grid operators and market participants project upcoming grid conditions. A coordinated cyberattack on forecasting related data and/or models by sophisticated adversary may render the existing bad data or outlier detection methods for load data ineffective and may have very negative impact on operational decisions. A generic method based on “Symbolic Aggregation approximation” (SAX) for detecting abnormal patterns in time series data is introduced and combined with existing point anomaly detection methods to develop an integrated solution in this study. A set of time series load data is used in this study to demonstrate the effectiveness of the integrated anomaly detection for different sophisticated cyberattacks.