Data-driven Online Detection of Replay Attacks on Wide-Area Measurement Systems

Attacks replaying pre-recorded data packets are difficult to detect since these are copies of actual disturbance data from a previous time instant. Assuming that only a few sensors can actually be tampered at any given time, it is suggested that the incoherence between the actual and tampered sensor readings be used in flagging an attack. Aligned to this theme, the paper presents two different schemes for replay attack detection. The singular value decomposition approach proposed in the paper is based on the relative change in ratios of dominant singular values of a data window sliding in time, while the proposed Pearson correlation based approach utilizes the time-series correlation between the neighboring PMU measurements as an instrument for attack detection. It is proposed that these detection schemes be incorporated in the wide area monitoring system as data preprocessing units for anomaly identification. The effectiveness of the detection schemes are studied on a test system and their merits and limitations are discussed.