A Test Bed for Detecting False Data Injection Attacks in Systems With Distributed Energy Resources

Previous theoretical studies have identified possible conditions for an undetectable false data injection attack (FDIA) vector that bypasses bad data detectors in power system state estimators. The formulation of the FDIA vector has attracted many researchers to propose detection algorithms. However, neither the attack formulation nor the proposed detection algorithms have been experimentally proven or validated. In this article, a framework for developing cybersecurity test beds that evaluate FDIA vectors for utility-scale distributed energy resources (DERs) and SE in real-time is proposed and implemented. The test bed is a combination of: 1) simulation models of utility-scale DER and distribution systems using OPAL-RT; 2) intelligent electronic devices (SEL-351S, SEL-311C, and SEL-3355); 3) network devices; and 4) graphical user interface (LabVIEW). The combination of actual devices, modeled systems, and cyber–physical interfaces adds realistic constraints, such as sampling error, network jitter, and data time alignment that exist during actual power system operations. Using the test bed framework, results show that the onset of the FDIA against a state estimator is experimentally detectable. Next, the test bed is used to expose an unknown vulnerability of existing phase-locked loop (PLL) techniques by presenting a new class of attack that causes PLL reporting of false phase angle and frequency values to the DER controllers. This type of attack would, then, induce the DERs to perform an adverse control action. In this article, a new detection algorithm based on a Kalman filter is evaluated to detect this type of PLL attack. A detailed evaluation of various attack scenarios is presented. The results indicate the benefits of employing this type of test bed framework to improve the development of cybersecurity defenses for realistic inverter-based DER environments.