Method and apparatus for detecting cyber attacks on an alternating current power grid

McEachern, Alexander; Hofmann, Ronald

Title: Method and apparatus for detecting cyber attacks on an alternating current power grid

Abstract

A method and apparatus for detecting cyber attacks on remotely-operable elements of an alternating current distribution grid. Two state estimates of the distribution grid are prepared, one of which uses micro-synchrophasors. A difference between the two state estimates indicates a possible cyber attack.

Inventors:: McEachern, Alexander; Hofmann, Ronald

Issue Date:: 2017-04-11

Research Org.:: Power Standards Lab, Alameda, CA (United States)

Sponsoring Org.:: USDOE

OSTI Identifier:: 1350990

Patent Number(s):: 9621569

Application Number:: 14/869,865

Assignee:: McEachern, Alexander (Oakland, CA)

Patent Classifications (CPCs):: H - ELECTRICITY H02 - GENERATION H02J - CIRCUIT ARRANGEMENTS OR SYSTEMS FOR SUPPLYING OR DISTRIBUTING ELECTRIC POWER

H - ELECTRICITY H04 - ELECTRIC COMMUNICATION TECHNIQUE H04L - TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION

Show more

H - ELECTRICITY H02 - GENERATION H02J - CIRCUIT ARRANGEMENTS OR SYSTEMS FOR SUPPLYING OR DISTRIBUTING ELECTRIC POWER
H02J13/00 - Circuit arrangements for providing remote indication of network conditions, e.g. an instantaneous record of the open or closed condition of each circuitbreaker in the network
H02J13/00002 - {characterised by monitoring}
H02J13/00034 - {the elements or equipment being or involving an electric power substation}
H02J3/00 - Circuit arrangements for ac mains or ac distribution networks

H - ELECTRICITY H04 - ELECTRIC COMMUNICATION TECHNIQUE H04L - TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
H04L63/1416 - {Event detection, e.g. attack signature detection}
H04L63/1425 - {Traffic logging, e.g. anomaly detection}
H04L63/1441 - {Countermeasures against malicious traffic

Y - NEW / CROSS SECTIONAL TECHNOLOGIES Y02 - TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE Y02E - REDUCTION OF GREENHOUSE GAS [GHG] EMISSIONS, RELATED TO ENERGY GENERATION, TRANSMISSION OR DISTRIBUTION
Y02E60/00 - Enabling technologies or technologies with a potential or indirect contribution to GHG emissions mitigation

Y - NEW / CROSS SECTIONAL TECHNOLOGIES Y04 - INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS Y04S - SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
Y04S10/30 - Systems characterised by state monitoring, e.g. fault, temperature monitoring, insulator monitoring, corona discharge
Y04S40/20 - Information technology specific aspects

Show less

DOE Contract Number:: AR0000340

Resource Type:: Patent

Resource Relation:: Patent File Date: 2015 Sep 29

Country of Publication:: United States

Language:: English

Subject:: 99 GENERAL AND MISCELLANEOUS; 24 POWER TRANSMISSION AND DISTRIBUTION

Citation Formats


                    McEachern, Alexander, and Hofmann, Ronald. Method and apparatus for detecting cyber attacks on an alternating current power grid.  United States: N. p., 2017. 
        Web.

Copy to clipboard


                    McEachern, Alexander, & Hofmann, Ronald. Method and apparatus for detecting cyber attacks on an alternating current power grid.  United States.

Copy to clipboard


                    McEachern, Alexander, and Hofmann, Ronald. Tue .  
        "Method and apparatus for detecting cyber attacks on an alternating current power grid".  United States.  https://www.osti.gov/servlets/purl/1350990.

Copy to clipboard


                    
@article{osti_1350990,

  title        = {Method and apparatus for detecting cyber attacks on an alternating current power grid},

  author       = {McEachern, Alexander and Hofmann, Ronald},

  abstractNote = {A method and apparatus for detecting cyber attacks on remotely-operable elements of an alternating current distribution grid. Two state estimates of the distribution grid are prepared, one of which uses micro-synchrophasors. A difference between the two state estimates indicates a possible cyber attack.},

  doi          = {},

  journal      = {},
number       = ,

  volume       = ,

  place        = {United States},

  year         = {2017},

  month        = {4}

}

Copy to clipboard

Patent:

Save / Share:

Export Metadata

Save to My Library

Works referenced in this record:

Malicious Attack Detection and Analysis
patent-application, November 2011

Scott, Anthony David
US Patent Application 13/103538; 20110288692
URL: https://image-ppubs.uspto.gov/dirsearch-public/print/downloadPdf/20110288692

System For Securing Electric Power Grid Operations From Cyber-Attack
patent-application, October 2015

Gooding, Jeff; McDonald, Jeremy
US Patent Application 14/228730; 20150281278
URL: https://image-ppubs.uspto.gov/dirsearch-public/print/downloadPdf/20150281278

Similar Records in DOE Patents and OSTI.GOV collections:

Systems and methods for detecting and mitigating cyber attacks on power systems comprising distributed energy resources

Patent Johnson, Jay Tillay

Extensive deployment of interoperable distributed energy resources (DER) on power systems is increasing the power system cybersecurity attack surface. National and jurisdictional interconnection standards require DER to include a range of autonomous and commanded grid-support functions which can drastically influence power quality, voltage, and the generation-load balance. Investigations of the impact to the power system in scenarios where communications and operations of DER are controlled by an adversary show that each grid-support function exposes the power system to distinct types and magnitudes of risk. The invention provides methods for minimizing the risks to distribution and transmission systems using an engineeredmore » « less
Full Text Available
Method for detecting sophisticated cyber attacks

Patent Potok, Thomas E [Oak Ridge, TN]

A method of analyzing computer intrusion detection information that looks beyond known attacks and abnormal access patterns to the critical information that an intruder may want to access. Unique target identifiers and type of work performed by the networked targets is added to audit log records. Analysis using vector space modeling, dissimilarity matrix comparison, and clustering of the event records is then performed.
Full Text Available
Systems and methods for global cyber-attack or fault detection model

Patent Xu, Rui; Yan, Weizhong; Abbaszadeh, Masoud; ...

An industrial asset may have monitoring nodes that generate current monitoring node values representing a current operation of the industrial asset. An abnormality detection computer may detect when a monitoring node is currently being attacked or experiencing a fault based on a current feature vector, calculated in accordance with current monitoring node values, and a detection model that includes a decision boundary. A model updater (e.g., a continuous learning model updater) may determine an update time-frame (e.g., short-term, mid-term, long-term, etc.) associated with the system based on trigger occurrence detection (e.g., associated with a time-based trigger, a performance-based trigger, anmore » « less
Full Text Available
Cyber-attack detection and neutralization

Patent Mestha, Lalit Keshav; Anubi, Olugbenga; Abbaszadeh, Masoud

The example embodiments are directed to a system and method for neutralizing abnormal signals in a cyber-physical system. In one example, the method includes receiving input signals comprising time series data associated with an asset and transforming the input signals into feature values in a feature space, detecting one or more abnormal feature values in the feature space based on a predetermined normalcy boundary associated with the asset, and determining an estimated true value for each abnormal feature value, and performing an inverse transform of each estimated true value to generate neutralized signals comprising time series data and outputting themore » neutralized signals. « less
Full Text Available
Cyber-attack detection, localization, and neutralization for unmanned aerial vehicles

Patent Mestha, Lalit Keshav; Anubi, Olugbenga; John, Justin Varkey

In some embodiments, an Unmanned Aerial Vehicle (“UAV”) system may be associated with a plurality of monitoring nodes, each monitoring node generating a series of monitoring node values over time that represent operation of the UAV system. An attack detection computer platform may receive the series of current monitoring node values and generate a set of current feature vectors. The attack detection computer platform may access an attack detection model having at least one decision boundary (e.g., created using a set of normal feature vectors a set of attacked feature vectors). The attack detection model may then be executed andmore » « less
Full Text Available

Similar Records

Title: Method and apparatus for detecting cyber attacks on an alternating current power grid

Abstract

Citation Formats

Malicious Attack Detection and Analysis patent-application, November 2011

System For Securing Electric Power Grid Operations From Cyber-Attack patent-application, October 2015

Malicious Attack Detection and Analysis
patent-application, November 2011

System For Securing Electric Power Grid Operations From Cyber-Attack
patent-application, October 2015