Detection of Falsified Commands on a DER Management System

Distributed energy resource management systems (DERMS) are increasingly deployed to manage potential adverse impacts of DERs on distribution feeder voltages. However, communication channels used by DERMS controllers, along with the unmanned substations where they are deployed, provide a target for cyber attackers to cause severe voltage disturbances. The voltage problems can damage equipment, trip inverters, and cause undesirable operations of voltage regulating devices. In this paper, using detailed cyber-physical models, the various cyberattack paths an adversary may use to conduct falsified control command cyberattacks are presented. Robust and fast acting centralized cyber layer and de-centralized inverter intrusion detection are also proposed. This two-tiered system can detect and mitigate these cyberattacks before the power system layer is impacted, even if the DERMS controller itself has been compromised. The cyberattack models and proposed intrusion detection techniques have been validated using IEEE test feeders.