Cybersecurity Analytics for Virtual Power Plants

This article presents a framework to realize cybersecure virtual power plant (VPP). The foundation of this cybersecurity analytics is established on a developed normal operation region identification methodology. This normal operation region is exploited as a confirmation strategy to distinguish malicious set-points that are determined by VPP cyber-layer. These malicious set-points are spawned by a cyber-attacker influencing the VPP cyber-layer. The normal operation region is based on a derived one-to-one mapping between the network internal point of common coupling (PCC) bus voltages and the cyber-layer generated set-points. This derived mapping is compared with an inverse mapping through internal PCC bus voltage monitoring for anomalies. Once, an inconsistency is witnessed by the cybersecurity analytics between the one-to-one mapping and the inverse mapping, then the initial voltage anomaly detected by the monitoring system is due to an intrusion. The developed theory is validated through simulation of a cyber attacker gradually violating the network stability boundary through manipulating the operation set-points.