Cyber Resiliency Enhancement of Overcurrent Relays in Distribution Systems

Directional overcurrent relays (DOCRs) depend on voltage and current measurements to initiate correct protection actions when faults occur. However, cyber-attacks can manipulate those measurements to make DOCRs output false tripping signals that may cause load shedding, power loss, and distribution lines isolation. Therefore, this paper employs Random Forest Decision (RFD), i.e., a machine learning algorithm, to detect and diminish false data injection attacks (FDIAs) and time synchronization attacks (TSAs) on inverse-time and time-current-voltage DOCRs. The employed RFD is trained to tackle grid faults and cyber-attack events as a classification problem. Thus, two classification types are considered: a binary classification that differentiates cyber-attacks from grid faults and a multi-class classification that identifies the attacked phase(s) and specifies the grid fault type. Furthermore, the training process for the binary and multi-class classification accounts for multiple noise levels that may affect the measured voltages and currents. The RFD is trained, validated, and tested on a Canadian benchmark distribution system. The results reveal the RFD’s ability to produce high-accuracy predictions to identify cyber-attacks and verify grid fault conditions without being affected by the system’s operating conditions and measurements’ noise.