Dual-Tier Cyberattack Detection for Distributed Energy Resource Aggregators

As distributed energy resources (DERs) and DER aggregators are integrated into distribution systems, the attack surface of critical power infrastructure expands. Built-in cryptography is effective against some false data injection (FDI) attacks, man-in-the-middle attacks, and tampered data from unauthenticated sources but cannot detect denial of service (DoS) attacks or FDI attacks originating from already-authenticated devices. This paper proposes a Dual-Tier Cyberattack Detection (DTCD) algorithm implemented within a DER aggregator that detects cyberattacks within the cyber and physical layers of a DER-integrated distribution system. The first tier, or cyber filter (CF), applies rule-based cyber checks to detect protocol-level DoS attacks, including TCP floods, SYN floods, and port scan attacks, and timestamp-based FDI anomalies. The second tier, or voltage anomaly detector (VAD), applies a physics-based Gradient Boosting Machine (GBM) dual-fusion model to detect event-driven FDI attacks by evaluating whether observed bus voltage deviations can be explained by expected load or photovoltaic (PV) changes. The algorithm is validated in real-time hardware-in-the-loop (HIL) testing on the PNNL powerNET cyberphysical testbed using an IEEE 123 bus model with DNP3 communication. CF detects all four tested attack signatures under partially mitigated traffic conditions with sub-50 ms detection times. VAD achieves a pooled F1-score of 0.875 and a receiver operating characteristic area under the curve (ROC AUC) of 0.802 across six attack scenarios at three operating conditions and four test days. VAD completes analysis in 2363 ms on average, within the sub-SCADA timeline. A two-tier comparison study shows that DTCD’s cyber check and physics-based tiers outperform cryptographic and signature-based intrusion detection approaches in the first tier and a standalone-GBM approach in the second tier. The two tiers operate in parallel and provide complementary coverage of DoS and FDI attacks. Replacing CF misses timestamp anomalies, and replacing VAD lowers the FDI F1-score. Results demonstrate that the proposed algorithm effectively complements cryptographic prevention as a detection layer, can provide cybersecurity coverage for legacy devices through aggregator-level packet screening, and completes its analysis within the sub-SCADA operational window.