A Real-Time Attack Localization Algorithm for Large Power System Networks Using Graph-Theoretic Techniques

We develop a graph-theoretic algorithm for localizing the physical manifestation of attacks or disturbances in large power system networks using real-time synchrophasor measurements. We assume the attack enters through the electro-mechanical swing dynamics of the synchronous generators in the grid as an unknown additive disturbance. Considering the grid to be divided into coherent areas, we pose the problem as to localize which area the attack may have entered using relevant information extracted from the phasor measurement data. Our approach to solve this problem consists of three main steps. We first run a phasor-based model reduction algorithm by which a dynamic equivalent of the clustered network can be identified in real-time. Second, in parallel, we run a system identification in each area to identify a transfer matrix model for the full-order power system. Thereafter, we exploit the underlying graph-theoretic properties of the identified reduced-order topology, create a set of localization keys, and compare these keys with a selected set of transfer function residues. We validate our results using a detailed case study of the two-area Kundur model and the IEEE 39-bus power system.