Machine Learning-Enhanced Security for Distance Relays Against Cyber-Attacks

Modern systems depend on accurate data for reliable operation and protection. However, their cyber-physical nature makes them susceptible to cyber-attacks that can manipulate measurements and relay settings. Distance protection is a highly selective scheme for such systems, detecting faults based on the measured impedance at the relay location. Specifically, current and voltage measurements at relay point are utilized to compute the apparent impedance, which is then compared to predefined settings to detect fault events. Thus, this relay uses current and voltage inputs for fault detection, making it vulnerable to cyber-attacks that cause false tripping. This paper proposes a novel approach to enhance distance relay security by using machine learning, specifically random forest classifier (RFC), to detect and mitigate various cyber-attacks such as false data injection attacks (FDIA) and tap setting attacks (TSA). The proposed approach is trained to differentiate between real faults and cyber-attacks as a binary classification, indicating whether the relay operation should be permitted or blocked. The proposed model is evaluated on a modified IEEE 33-bus system, demonstrating its ability to distinguish between normal and malicious activities.