Cyber-Resilient System Identification for Power Grid through Bayesian Integration
This work addresses cyber resilience for power grid operators, offering a method that integrates snapshot-based and time-series models to improve accuracy and anomaly detection, though it is incremental as it builds on existing approaches.
The paper tackles the problem of real-time situational awareness in power grids under cyber threats by advancing system identification to be resilient against both random and targeted false data, achieving over 70% reduction in estimation error under false data injection attacks and maintaining scalability with processing times under 1 minute per time tick on a large system.
Power grids increasingly need real-time situational awareness under the ever-evolving cyberthreat landscape. Advances in snapshot-based system identification approaches have enabled accurately estimating states and topology from a snapshot of measurement data, under random bad data and topology errors. However, modern interactive, targeted false data can stay undetectable to these methods, and significantly compromise estimation accuracy. This work advances system identification that combines snapshot-based method with time-series model via Bayesian Integration, to advance cyber resiliency against both random and targeted false data. Using a distance-based time-series model, this work can leverage historical data of different distributions induced by changes in grid topology and other settings. The normal system behavior captured from historical data is integrated into system identification through a Bayesian treatment, to make solutions robust to targeted false data. We experiment on mixed random anomalies (bad data, topology error) and targeted false data injection attack (FDIA) to demonstrate our method's 1) cyber resilience: achieving over 70% reduction in estimation error under FDIA; 2) anomalous data identification: being able to alarm and locate anomalous data; 3) almost linear scalability: achieving comparable speed with the snapshot-based baseline, both taking <1min per time tick on the large 2,383-bus system using a laptop CPU.