A Testbed for Detecting False Data Injection Attacks in Systems with Distributed Energy Resources

Previous theoretical studies have identified possible conditions for an undetectable false data injection attack (FDIA) vector that bypasses bad data detectors in power system state estimators (SE). The formulation of the FDIA vector has attracted many researchers to propose detection algorithms. However, neither the attack formulation nor the proposed detection algorithms have been experimentally proven or validated. In this paper, a framework for developing cybersecurity testbeds that evaluate FDIA vectors for utility-scale distributed energy resources (DERs) and SE in real-time is proposed and implemented. The testbed is a combination of: 1) simulation models of a utility-scale DER and distribution systems using OPAL-RT; 2) intelligent electronic devices (SEL-351S, SEL-311C and SEL-3355); 3) network devices; and 4) graphical user interface (LabVIEW). The combination of actual devices, modeled systems, and cyber-physical interfaces adds realistic constraints such as sampling error, network jitter, and data time alignment that exist during actual power system operations. Using the testbed framework, results show that the onset of the FDIA against a SE is experimentally detectable. Next, the testbed is used to expose an unknown vulnerability of existing phase locked loop (PLL) techniques by presenting a new class of attack that causes PLL reporting of false phase angle and frequency values to the DER controllers. This type of attack would then induce the DERs to perform an adverse control action. In this research, a new detection algorithm based on a Kalman filter is evaluated to detect this type of PLL attack. A detailed evaluation of various attack scenarios is presented. The results indicate the benefits of employing this type of testbed framework to improve the development of cybersecurity defenses for realistic inverter based DER environments.