Data-Driven Detection of Stealth Cyber-Attacks in DC Microgrids

Cyber-physical systems such as microgrids contain numerous attack surfaces in communication links, sensors, and actuators forms. Manipulating the communication links and sensors is done to inject anomalous data that can be transmitted through the cyber layer along with the original data stream. The presence of malicious, anomalous data packets in the cyber layer of a dc microgrid can create hindrances in fulfilling the control objectives, leading to voltage instability and affecting load dispatch patterns. Hence, detecting anomalous data is essential for the restoration of system stability. This article answers two important research questions: 1) Which data-driven detection scheme offers the best detection performance against stealth cyber-attacks in dc microgrids? 2) What is the detection performance improvement when fusing two features (i.e., current and voltage data) for training compared with using a single feature (i.e., current)? Our investigations revealed that 1) adopting an unsupervised deep recurrent autoencoder anomaly detection scheme in dc microgrids offers superior detection performance compared with other benchmarks. The autoencoder is trained on benign data generated from a multisource dc microgrid model. 2) Fusing current and voltage data for training offers a 14.7% improvement. The efficacy of the results is verified using experimental data collected from a dc microgrid testbed when subjected to stealth cyber-attacks.