Real-Time Detection of Cyber-Physical False Data Injection Attacks on Power Systems

This paper studies the online detection of false data injection attacks (FDIAs) and coordinated cyber-physical attacks (CCPAs) on power systems. By analyzing the hidden physical meaning of CCPAs, a cyber-physical FDIA with CCPA as a special case is proposed to establish the connection between FDIA and CCPA. Based on a discrete-time system dynamic model, an adaptive nonparametric cumulative sum (AN-CUSUM) detector is devised to deal with FDIAs and CCPAs simultaneously. The AN-CUSUM algorithm estimates the abnormal change of the state vector caused by attacks one step in advance, and standardizes the decision statistics of conventional CUSUM to simplify the setting of thresholds. The proposed detector is robust to a wide range of time-varying system states and attack magnitudes. Moreover, a verification method is designed in the proposed detector to differentiate CCPAs and FDIAs according to unique characteristics of CCPAs; namely, the construction of CCPAs depends on the physical system parameter. Numerical results reveal that the proposed detector is more reliable to detect both FDIAs and CCPAs than existing CUSUM-based methods.