Cyber-Attack Identification of Synchrophasor Data Via VMD and Multi-fusion SVM

A large amount of synchrophasor data in the Wide Area Measurement System (WAMS) needs to be collected and transmitted to the phasor data concentrator, thereby increasing the possibility of being attacked by hackers. The attacked data is therefore hidden into the normal data. To remedy this problem, an identification framework is proposed to detect the cyber-attack in WAMS utilizing Variational Mode Decomposition (VMD) and Multi-fusion Support Vector Machine (MSVM). First, VMD is used to transforms the modified data into multiple modal components and then MSVM is employed to classify the deterministic features using the linear combined multi-kernel. This linear combined multi-kernel fuses multiple types of features including time, frequency and statistical variables of the synchrophasor data. Utilizing the actual data from FNET/GridEye, different experiments are conducted under multiple attack strengths and types. The results show that the identification framework has a higher accuracy and robustness compared with other conventional classifiers.