Intrusion Detection, Measurement Correction, and Attack Localization of PMU Networks

Accurate state estimation is essential for correct supervision of power grids. With the existence of cyber-attacks, state estimation may become inaccurate, which can eventually lead to wrong supervisory decision making. To detect cyber-attacks in power grids equipped with phasor measurement units (PMUs), a new intrusion detection system based on clustering approach, called PMU Intrusion Detection System (PMUIDS), is proposed in this article. After solving the optimal PMU placement in
N
-1 contingency, several static state estimations are obtained by removing the measurements of one PMU in each time. The resulting state vectors are clustered in two steps: First, subtractive clustering is employed to obtain the number of clusters, which determines the number of integrity attacks; and second, fuzzy C-means clustering assigns the state vectors to the corresponding clusters, which determines the attacked PMUs. In addition, two theorems are proved, which indicate that the attacker cannot coordinate successful stealth attacks in cases that by removing attacked PMUs from state estimation, the power system still remains full observable. Furthermore, in the case of possible stealth attacks, the attacker cannot falsify the estimation of any arbitrary state variable. The hardware-in-the-loop results on a sample power system show that the proposed approach can detect integrity attacks, determine the number of attacks, obtain the correct state vector, and localize the attacks, even in case of multiple simultaneous attacks.