Anomaly Detection for Power System Generation Control based on Hierarchical DBSCAN

The generation level of a generator in power grid is under control of multiple control loops such as governor action, Automatic Generation Control (AGC), and manual control. These control loops are vulnerable to cyber attacks and could become potential targets for the malicious adversary. In this paper, we investigated the detection of abnormal generation controls induced by cyber attacks. One data-driven anomaly detection methodology is presented based on the behavior conformity of generation units located in the same balancing authority. A semi-supervised clustering algorithm with Hierarchical Density based Spatial Clustering of Application with Noise (HDBSCAN) is proposed for the detection model training. In our previous work, we obtained a synthetic dataset that covers scenarios including normal operation, generation control under ramp attack, switching attack, AGC integrity attacks, etc. and it is used to evaluate the proposed clustering algorithm. Experimental results show that the proposed algorithm provides better detection accuracy than K-means clustering and can distinguish not only between normal and abnormal generation controls but also among various anomaly scenarios.