A Dynamic Strategy for Cyber-Attack Detection in Large-scale Power Systems via Output Clustering

Abstract

In this paper we are concerned with reliable operation of the electric power grid in presence of malicious cyber-attacks on measurement signals. We use the continuously changing operating conditions of the power systems to introduce an active defense method based on dynamic clustering. Our detection strategy uses a moving-target approach where information about the system's varying operating point is first used to form dynamic clusters of measurements based on their dynamic response to disturbances. Then, similarity checks can be performed within each cluster to detect stealthy cyber-attacks. The proposed method is effective even when the attacker has extensive knowledge of the system parameters, model and detection policy at some point in time.