Jin Wei Assistant Professor, Department of Electrical & Computer Engineering 12/15/2015

1. A Data-Driven Cyber-Physical Detection and Defense Strategy Against Data Integrity Attacks in Smart Grid Systems Jin Wei Assistant Professor, Department of Electrical & Computer Engineering 12/15/2015

2. Outline • Introduction • Problem Setting • Detection and Defense Strategy • Simulations • Conclusions

3. Introduction • The attacks targeting availability, integrity, and confidentiality are identified as the major security issues for smart grids. • We focus on one typical data integrity attack, false data injection attack.

4. Introduction • The tremendous amount of real-time data, such as PMU data, demands the appropriate data analysis and control techniques. • Deep Belief Network (DBN) is coming to play a key role in providing big data predictive analytics solutions.

5. Problem Setting • A two-tier hierarchical cyber-physical multi-agent control framework for modeling the transient stability problem. Agent 3 Agent 9 Agent 7

6. Problem Setting • A two-tier hierarchical cyber-physical multi-agent control framework for modeling the transient stability problem. Agent 3 Agent 9 Agent 7

7. Problem Setting • A two-tier hierarchical cyber-physical multi-agent control framework for modeling the transient stability problem. • Inter-cluster (Tier-1): lead agents achieve frequency synchronization via cyber-physical couplings. • Intra-cluster (Tier-2): multiple secondary agents achieve synchronization via strong physical couplings with a stabilized lead agent. • Only lead agent PMU information is needed to ensure transient system stabilization in the face of a disturbance. How to defend against the false data injection attack on the lead agent PMUs?

8. Detection and Defense Strategy

9. Detection and Defense Strategy • In the hierarchical framework, the states of the secondary agents can be treated as “noisy” version of those of the lead agents. • The PMU data from the lead agents can be validated using the PMU data from the secondary agents.

10. Detection and Defense Strategy • The PDC works as an aggregator in the intra-cluster LAN to verify the trustworthiness of the lead agent’s PMU data.

11. Detection and Defense Strategy • The PDC works as an aggregator in the intra-cluster LAN to verify the trustworthiness of the lead agent’s PMU data. • The PDC probes the PMU data from all of the N secondary agents at a verification rate for learning the features of the PMU data of the cluster of agents and thus predicting the behavior pattern of the PMU data of the associated lead agent. • Using Deep-learning Technique • The PDC also probes the lead agent’s data at the same rate and measure the trustworthiness of a lead agent’s data by using the predicted behavior pattern. A key step in pattern recognition is to select a proper set of features with which the input data will be represented.

12. Detection and Defense Strategy

13. Detection and Defense Strategy • All of the three DBNs are trained by stacking Gaussian-Bernoulli Restricted Boltzmann Machines and have the same structures with decreasing width. Fig. 1: Deep Belief Network Structure

14. Detection and Defense Strategy • All of the three DBNs are trained by stacking Gaussian-Bernoulli Restricted Boltzmann Machines and have the same structures with decreasing width.

15. Detection and Defense Strategy

16. Simulations The standard IEEE 118-Bus test system is modified for transient stability studies by replacing the generator and synchronous condensers of less than 50 MVA rating with appropriate constant impedances. Fig. 2: The standard IEEE 118-Bus test system

17. Simulations Fig. 3: Normalized rotor frequencies and phase angles versus time without active control and cyber-physical detection and defense strategy.

18. Simulations Fig. 4: Normalized rotor frequencies and phase angles versus time with active control and without cyber-physical detection and defense strategy.

19. Simulations Fig. 5: Normalized rotor frequencies and phase angles versus time with active control and cyber-physical detection and defense strategy.

20. Simulations • We proposed the a deep learning-based approach to detect and defend against the potential false data injection attack on the critical data for the application of maintaining the transient stability of real-time WAMS. • Future work will examine a generalized class of threat models for which the approach is able to identify data corruption.

21. Questions