Episodic Detection of Spoofed Data In Synchrophasor Measurement Streams

Phasor Measurement Units (PMUs) provide high-quality state information about the electrical grid in near-real time. However, as utilities become more reliant on these measurements, the devices themselves as well as the communication network that supports them will likely become a more prominent attack surface for cyber threats. In this paper, we demonstrate a system designed to find anomalous PMU data–specifically data that is intended to provide false signal readings (spoofed data) over a period of time. Our system uses support vector machines to distinguish between “normal” system operation and “spoofed” operation. The work presented here makes three main contributions. Specifically, we demonstrate: (1) a SVM-based classifier that has reasonable longevity (i.e., once trained, the classifier remains valid for a reasonable length of time); (2) a distributed version of our classifier that improves the efficiency and scalability; and (3) the classifiers above can be used to detect spoofs at different levels of fidelity which can have a dramatic effect on their suitability in a real-world operating environment.