securing fault localization applications · securing fault localization applications anna...
TRANSCRIPT
CYBER RESILIENT ENERGY DELIVERY CONSORTIUM | CRED-C.ORG
FUNDING SUPPORT PROVIDED BY THE U.S. DEPARTMENT OF ENERGY AND THE U.S. DEPARTMENT OF HOMELAND SECURITY
Securing Fault Localization ApplicationsAnna Scaglione, Teklemariam Tesfay
FAULT DETECTORS ARE VULNERABLE
PMU DATA FOR FAULT LOCALIZATION
COLLABORATION OPPORTUNITIES
Compare fault localization results that use data from a
limited number of PMUs with results from fault detectors
data analytics to detect the presence of a cyber attack.
ZONE IDENTIFICATION
CYBER ATTACK DETECTION
• Faults happen due to natural effects, man-made situations, or from
equipment failures
• Data from fault detectors allow fast fault detection and localization
• An attacker can manipulate the SCADA data from fault detectors to
give wrong fault location or hide its presence, thereby delaying
service restoration
• Analyzing aggregated data from multiple PMUs to localize fault
• Only few PMU deployed (economics!) forcing utilities to operate in
low measurement regime
• Not enough to pinpoint the exact location of a fault
Proposed formulation
• Localizes a fault with low resolution about the exact
location
• Uses pre- and post-fault data and bus admittance matrix
• Tested on an IEEE-34 bus system using OpenDSS to
generate simulated pre- and post-fault data.
This research would benefit from collaboration with industry
partners in the following areas:
• Datasets of PMU measurements and SCADA data from actual
distribution systems
• Industry level implementation for DMS to commercialize our solution
• Contact: [email protected], [email protected]
• Activity webpage: https://cred-c.org/researchactivity/Analytics
Fault
Type
Exact fault location Highly probably faulty nodes
LLL 816 814,816,850
A-G 822-A 814-A,816-A,818-A,820-A,822-A,850-A
BC-G 852-B-C 832-B-C,852-B-C
Future Direction
• Mathematical formulation for optimal PMU placement guaranteeing
minimum ambiguity throughout the network
• Implement the proposed method on SPARCS architecture
Simulation results show the presence of a cluster of nodes
(communities) as candidate fault locations
5
0
0.5
1
1.5
2
2.5
3
3.5
4
4.5
5
Obje
ctive F
unction V
alu
e
104
800 802 806 808 812 814 816 824 828 830 854 832 858 834 860 842 836 840 862 844 846 848 850 888 852 890
Fault Location Candidate Bus
20332094
Fig. 4. Objective Function Value of Eq. (6) for Three-Phase Fault-Bus 834 .
Scenario 2: In this scenario, we assume that the exact value
of the fault current is somehow given to us. The reason for this
assumption is to show that the approximate fault current is not
only the cause for the aforementioned ambiguity and, in fact,
the similarity of the corresponding columns of Za is the root
cause of this ambiguity. In this scenario, a three-phase fault is
introduced at bus 836. The result of the metric for this case
is given in Fig. 5. It is clear from the results that there is an
inherent ambiguity in locating the fault in this case even when
the exact fault current is available: due to the correlation of the
columns in Za buses 840, and 862 are prone to be mistaken
with bus 836 as the fault location.
B. Test-Case Community of Nodes
In this part, the correlation of the columns of the matrix
pre-multiplied by I E ,ℓ in Eq. (6) and Eq. (14) is shown. We
use the following definition to look at the normalized value of
the unsigned correlation of the columns.
Definition. The absolute value for the correlation coefficients
of the columns of a matrix X = [X 1, X 2, . . .] that is used is
defined as follows:
[C]m ,n =|X H
m X n |
||X m || ||X n ||(16)
Fig. 6 shows the correlation of the columns of Za (on the
left) and D (on the right) corresponding to phase-A that is
0
200
400
600
800
1000
1200
1400
Ob
jec
tive
Fu
nc
tio
n V
alu
e
834 860 842 836 840 862 844 846 848
Fault Location Candidate Bus
Fig. 5. Objective Function Value of Eq. (6) for Three-Phase Fault-Bus 836 .
produced using the definition4 given in Eq. (16) based on the
placement in Table. I.Before Whitening
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1After Whitening
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
Fig. 6. Correlation of Columns related to Phase-A of a) Z a and b) D .
In this figure,5 the correlated columns of Za in Fig. 6a form
smaller groups, due to the sensors placement. To better under-
stand the location of highly correlated nodes with respect to
each other, we first choose a threshold of τ on the correlation
coefficient and build an adjacency matrix A as follows:
[A ]m ,n =1 if [C]m ,n ≥ τ , m = n
0 else(17)
Fig. 7 shows a graph corresponding to the adjacency matrix
A , built using the correlation coefficients of columns of D
and overlaid on the IEEE-34 test case topology. The heat-map
Adjacency Matrix Graph
Fig. 7. Adjacency Matrix Graph for Correlation Coefficients of Columns ofD with τ = 0.814.
for the correlation coefficients of the columns corresponding
to phase-B and phase-C in the matrix D follow a similar
pattern as in Fig. 6 (b). As expected based on our analysis
in Section III-A, the nodes with high correlation are those
that are located in a neighborhood of each other. The fault
location in the presented approach can locate the fault up to
the resolution of these communities, which can be interpreted
as a low-resolution representation of the graph.
It should be noted that the communities that emerge are de-
pendent on the locations of the sensors. The placement based
on Table I has been done leveraging the heuristic discussed at
the end of Section III-A. To show how abad placement change
4Note that the correlation between the columns corresponding to phasei ( i = a, b, c) and j ( j = i ) is not important since for a faulty phase i ,the indices corresponding to phase j are not candidates. For example, whena three phase fault occurs, we want to put the first element of fault currentvector at locations corresponding to phase a so it is important how thesecolumns corresponding to phase a form communities no matter what theircorrelations are with respect to the columns corresponding to phase b or c.
5The ordering of the nodes have changed here to put the neighboring nodesas close as possible to each other to better visualize the communities, whereasthe actual matrix is separated as blocks of available and unavailable nodes.
• Nodes that have similar properties in
the fault localization application (that
have strong correlation) form a zone
• The size and structure of the zones are
dependent on the network topology
and the placement of PMUs
• Proposed a placement heuristics
guaranteeing balanced zone sizes
Zones are formed by neighboring nodes in a network
800802 806 808
810
812 814R1
850
816
818
820
822
824 826
828 830 854 856
852
R2
832
T1888 890
838
862
840836860834858
864842
844
846
848
Substation
DG1
IMPACT ON STATE OF GRID SECURITY
Impacts on Your Grid
• Prevent delayed recovery from a fault that could be caused as a result
of a cyber attack which mis-locates or hides the fault
Business Benefits
• Economic placement of PMUs
• Minimize economic lose by enabling fast isolation of fault locations
• Simulated SCADA data for fault detectors at each end of the lines is
generated using opendnp3.
• A-G fault introduced at 822-A
• PMU data analytics shows fault in buses 814-A,816-A,818-A,820-
A,822-A,850-A (Zone B)
• Simulated SCADA data from fault detectors manipulated such that the
analytics shows fault at 846-A (Zone D)
• Inconsistent results. Alarm about presence of a cyber attack!
800802 806 808
810
812 814R1
850
816
818
820
822
824 826
828 830 854 856
852
R2
832
T1888 890
838
862
840836860834858
864842
844
846
848
Substation
DG1Actual
fault locationFault location from
manipulated data
Faulty Zone identified using
μPMU data analytics
A
BC
D
F
RESEARCH VISION
SPARCS hierarchical architecture
Correlation coefficients threat-map
Local PMU data analytics
Local SCADA data analytics
Cassandra /Elastic Search Databases
Central PMU analytics
Central SCADA data analytics
…Check for
inconsistency
…
800802 806 808
810
812 814R1
850
816
818
820
822
824 826
828 830 854 856
852
R2
832
T1888 890
838
862
840836860834858
864842
844
846
848
Substation
DG1
PMU Fault detector
010…
Attacker