Time-frequency based cyber security defense of wide-area control system for fast frequency reserve

Highlights

• Impact and threat of cyber security are analyzed in WAMS-based FFR control system.

• Novel dual-frequency scale CNN for processing the spoofing data from two scales.

• Time-frequency based cyber security defense framework for WAMS-based FFR system.

• The result shows higher accuracy and robustness with actual synchrophasor data.

Abstract

Global power systems are transiting from conventional fossil fuel energy to renewable energies due to their environmental benefits. The increasing penetration of renewable energies presents challenges for power system operation. The efficiency and sufficiency of responsive reserves have become increasingly important for power systems with a high proportion of renewable energies. The Fast Frequency Reserve (FFR), especially the Wide-area Monitoring System (WAMS)-based FFR, is a promising and effective solution to secure and enhance the stability of power systems. However, cyber security has become a new challenge for the WAMS-based FFR system. Cyber attacks on the FFR control system may threaten the safety of power system operation due to the rapid power controllability requirement of FFR. To address this problem, a time-frequency based cyber security defense framework is proposed to detect the cyber spoofing of synchrophasor data in WAMS-based FFR control systems. This paper first introduces the Continuous Wavelet Transforms (CWTs) to decompose spoofing signals. Then, the Dual-frequency Scale Convolutional Neural Networks (DSCNN) is proposed to identify the time-frequency domains matrix from two frequency scales. Integrating CWTs and DSCNN, an identification framework called CWTs-DSCNN is further proposed to detect the spoofing attacks in the WAMS-based FFR system. Multiple experiments using the actual data from FNET/GridEye are performed to verify the effectiveness of the framework in securing WAMS-based FFR systems.

Introduction

The transition of global energy from fossil fuel energy to renewable energy has significantly accelerated in the past decade [1], [2]. According to 2020 Renewable Global Status Report, the newly installed capacity of renewable energies is record-breaking in 2019, growing by more than 200 gigawatts (GW), which is the largest installation capacity increase in history [3]. Additionally, as research and development efforts and energy policies in almost all countries are increasingly focusing on renewable energy development, it is clear that the renewable penetration in power systems will continually increase in the foreseeable future [4].

Due to the physical characteristics of renewable energies, renewable generation is usually integrated into power systems through Grid-connected Converters (GCCs) [5]. As is well known, system inertia is provided by generators and motors rotating at the same frequency, which forms the power grid frequency [6], [7]. However, the GCC connection decouples generator rotors to power grids, and some even do not have mechanical rotors. Therefore, most renewable energies can not provide the necessary grid services [8]. With the increasing penetration of renewable energies, the system inertia decreases inevitably. When an event occurs (e.g., generator trip or load loss), the stability of the power system with a high proportion of renewable energies will be more vulnerable. For example, the Rate of Change of Frequency (RoCoF) and the frequency deviation would be larger for the same amount of power imbalance, and finally leads to the tripping of protection relays [9]. As the generation mix changes, maintaining the system frequency at acceptable levels becomes a thorny issue [10].

To handle the emergency operating situations of low inertia systems, Fast Frequency Reserve (FFR) has received much attention in recent years [11], [12]. According to the definition by the North American Electric Reliability Corporation (NERC), FFR is designed to provide a fast power response to changes in the measured or observed frequency during a frequency excursion event [13]. In the past, the inertial response from synchronous generators is the dominant FFR in the system. With the conventional generator retired and replaced by renewable energies, system operators proposed higher response requirements [14]. In the frequency response requirement of the California Independent System Operator (CAISO), FFRs need to act within the first few seconds. The frequency response of synchronous generators cannot meet the operating requirement [15], [16]. The FFR provided by energy storage devices and fast-responding controls from renewable energies, such as batteries, flywheels, and kinetic energy extraction from Wind Generators (WGs), has become the mainstream in recent years [17], [18].

Due to its fast response capability to the frequency deviation, the FFR has been widely recognized as the primary response to the frequency excursion of low-inertia systems. Some frequency regulation methods based on the FFR response have been studied, including using the rotating kinetic energy from WG [19], [20], and extracting energy stored in DC links [21]. The demand-side response has also been studied, such as the aggregation of refrigerators [22], smart loads [23], and PV panel control [24].

So far, most control methods for FFRs are based on local frequency measurement. Due to its dependence on the geographical distribution of renewable resources and grid infrastructure, the location of renewable generation is typically distributed non-uniformly [25]. The local measurement-based FFRs cannot exactly match the power requirement and FFRs response. As a result, the output from the FFRs may not improve frequency performance and even cause inter-regional power oscillations [26]. With the advancement of the phasor measurement unit (PMU) in accuracy and the reporting rate, wide-area monitoring system (WAMS) provides system operators with an unprecedented way to monitor and control power systems. In [27], a WAMS-based FFR control system is presented, which uses real-time data from PMUs to determine the required responses and allocate them to FFRs. Compared to the conventional FFR control, this WAMS-based control could realize the coordination and optimization of FFR in the system, improving the system stability. With the increasing need of FFRs, the WAMS-based FFR is a promising solution for system stability enhancement.

However, the data security of PMUs has always been vulnerable as evidenced by the increasing reported cases of cyber attacks. Owing to their operating principle and communication methods, PMUs are easy to be penetrated [28]. In various attack methods, the network-based false data injection (NFDI) attack may seriously influence the authenticity of data, causing malfunction of FFRs, which is even worse than the case without FFRs. Considering the fast response capability of FFRs, the risk of the reverse direction regulation of FFRs could be a potential disaster to the system stability. Therefore, cyber-attack detection becomes essential for the FFR response.

Due to its importance, there has been some research on the defense against power grid attacks. In [29], the hijacking attacks are detected in DC microgrids using the distributed screening method. The attack on the AC/HVDC interconnected system has also been studied in [30] through manipulating the system measurements of frequencies. However, these methods require the values of other parameters of the circuit, such as the current, to achieve accurate detection. This limits its application to the FFR control circuits. Meanwhile, from the energy perspective, the attack will deplete the available energy, including the batteries and photovoltaic [31]. A two-stage robust optimization is proposed to mitigate the uncertainties and adverse impacts caused by NFDI attacks in [32].

For the attack detection in frequency control systems, some research has also investigated the defense strategies for the cyber attack. [33] develops an approach based on a novel stochastic unknown input estimator to detect the attack in the AGC. The proposed method does not need information about real-time load changes, which significantly improve state estimation accuracy. Based on the state estimation accuracy, [34] analysis four different attack strategies and their impact on load frequency control. Based on the analysis results, a detection method based on a Multilayer perception classifier-based approach is proposed to extract the differences between the normal signal and compromised signals. Based on the passive fault attenuation principle, [35] design a new distributed cyber-attack-tolerant frequency control to improve the frequency performance and the tolerance under cyber attack. [36] develops a new virtual inertia control strategy that adopting the virtual damper to enhance the conventional virtual inertia control so that improve the frequency response performance such as frequency nadir and oscillation under the time delay attacks. One common feature of these attacks is the modification of the measurement data. In the NFDI attack, such measurements are tampered behaviors that can be considered as a replay attack. The replacement signal in these attacks can be very similar to the raw measurement, bringing challenges for accurate attack detection.

Depending on the robustness of attack detection, cyber security defense methods can be divided into model-based methods and model-free methods. Model-based methods usually establish state equations to detect the attack [37]. Changes in measured values will cause changes in state variables. Then, attacks can be detected based on the measurement residual vector or state variables [38]. These model-based methods build equations based on the system structure. Therefore, the configuration information on the previous state is needed, which sacrifices its generality and adaptability.

Model-free methods include traditional machine learning methods and deep learning methods [39]. They also belong to data-driven methods, which make full use of the PMU data in the FFR control system. For example, the Random Forest Classification (RFC) and gcForest are used to detect the spoofing attack by extracting the spatio-temporal characteristics from the synchrophasor data [40], [41]. Additionally, the data authentication method is proposed to detect the data spoofing based on ensemble empirical mode decomposition (EEMD) and back propagation (BP) neural network [42]. These methods are based on the frequency domain features of the signal, because the frequency domain information is considered to be consistent during a short time [43]. However, the period of this frequency information retention is not considered. In [44], the support vector machine is introduced for spoofing events recognition, and the handcrafted correlation vectors are designed for detecting spoofing attacks. However, the time domain-based recognition method is only applicable when the shape of the attack differs from the original measurement value. The above model-free methods either only contain frequency information or only contain time domain information, resulting in an insufficient response to complex attacks. Meanwhile, the simulated data is used in some research. For example, the intentional injections of false synchrophasor measurements detection method is verified based on the IEEE 39-Bus system [45]. Compared with the simulated data and the actual data, the components such as the noise level and frequency components are different. Massive measurement data increases the demand for deep learning methods, which have strong feature extraction capabilities.

Considering the big data in WAMS and the fast response requirement of FFR application, deep learning methods have been introduced for attack detection. In [46], the deep autoencoder is deployed to detect the data manipulation attacks, assuming that the data packets of PMU data can be modified. Besides, a recurrent neural network is proposed to identify the replaced false data in DC microgrids [47]. Nevertheless, the recurrent network is only suitable for the data with a certain trend, while synchrophasor measurement data is often random, especially frequency measurement values. Therefore, the convolutional neural networks (CNN), longshort-term memory (LSTM), and SVM are combined to for detecting tampering attacks using the raw signals in [48], which also demonstrated the profound feature extraction capabilities of deep learning. However, this combination makes this method very complicated and difficult to train. It can be seen from the results of the existing research that the optimized input space is worthy of further mining to improve the attack detection performance in the FFR control system, so that the response speed can be guaranteed and the FFR control reliability can be improved.

To increase the amount of input information and improve the performance of cyber-attacks detection, a cyber-security defense method is proposed in the WAMS-based FFR control systems. The proposed method includes the following innovations.

• To extract the information of the attack signal from multiple scales in the WAMS-based FFR control system, the Continuous Wavelet Transforms (CWTs) is applied to transform the spoofing signal and obtain features from the time and frequency domains to enhance feature diversity.

• To enhance the attack detection ability in the WAMS-based FFR control system, the Dual-frequency Scale CNN (DSCNN) is proposed to process the input data from two frequency scales. This scaling feature improves the detection ability of the spoofing attack.

• A spoofing attack identification framework of synchrophasor data is developed based on the CWTs and DSCNN. Particularly, the handcrafted feature design steps can be avoided.

• Importantly, the time-sensitivity experiment of the spoofing attack detection is first performed in this paper. Compared with some deep learning and advanced attack detection methods, the experimental results verify that the proposed CWTs-DSCNN framework has higher accuracy and better robustness.

The main contribution of this paper is the proposed CWTs-DSCNN, which provides a rapid and reliably cyber security defense mechanism for the WAMS-based FFR control system. The proposed method breaks through the speed and accuracy limitations of the traditional detection methods, significantly improving the operating security of the WAMS-based FFR control system. Additionally, the proposed method has been evaluated with actual synchrophasor data from the Western Interconnection (WECC) system, which verified its practical value in the WAMS-based FFR control system.

The rest of the paper is organized as follows. Section 2 describes the potential impact of the spoofing on the power system. Section 3 presents the time-frequency based signatures extraction using CWTs. And the proposed DSCNN is introduced in Section 4. Next, the proposed CWTs-DSCNN framework is listed in Section 5. Different experiments are conducted in Section 6. Finally, the results and conclusion are discussed in Section 7.