Machine learning-based anomaly detection methods to enhance cyber capability for electricity network protection and control

Digital substations are enablers for the electricity network power flow to be controlled and directed safely and securely from generation to demand, these make them a highly attractive target for cyber-attackers aimed at disrupting operations. As a result, Protection, Automation and Control (PAC) devices will be required not only as business usual to maintain effective detection of network normal and fault conditions but also to detect anomaly cyber-attack conditions. This paper proposes an anomaly detection method based on time series data and a Back Propagation (BP) neural network algorithm. The BP neural network is used to classify the anomaly data via extracting anomaly system state behaviour characteristics and then comparing them with normal system states. By using the supervising training and learning process, an anomaly Intrusion Detection System (IDS) is developed and used to determine when and whether anomaly data would occur. A benchmark 4 bus power system used by ABB and a typical distribution network substation with 2 power source infeeders and 4 load feeders were selected and modelled using Digsilent Power Factory simulation tool to obtain different time series network condition data as inputs to the implemented IDS. Results show that the BP neural network can accurately detect all tested anomaly cyber-attack conditions and provide the correct system state. The comparison between the proposed method and ABB algorithm proposed Kirchhoff's laws-based distributed agreement algorithm was made. By comparisons, the advantages and disadvantages of using the proposed method are discussed and highlighted.