Real-Time Cyber Attack Localization in Distribution Systems Using Digital Twin Reference Model

Identifying the locations of cyber attacks in power distribution systems is critical to take immediate and effective mitigation actions. This article introduces a novel real-time attack localization strategy for power distribution systems utilizing a Digital Twin (DT) as a cyber-physical real-time reference model that mimics the cyber-physical dynamic characteristics of the actual system. The proposed approach takes advantage of the DT-based reference model as well as the physical characteristics of the radial distribution network to compute a new metric, namely Residual Rate of Change (RRC), which allows differentiating False Data Injection (FDI) attacks on load measurements and protective devices. The RRC enables the determination of the attack's location by constructing a directed graph that characterizes the physical dependencies of protective devices. The proposed attack localization method is implemented on a testbed consisting of a digital real-time simulator, feeder protection devices, a real-time automation controller, and advanced communication infrastructure for a power distribution system. The provided experimental results demonstrate the capability of the proposed method to localize cyber attacks in various operation scenarios of the power distribution system. The results also illustrate that the introduced method outperforms a learning-based strategy in localizing different types of attacks in the test system.