Centralized Dynamic State Estimation Algorithm for Detecting and Distinguishing Faults and Cyber Attacks in Power Systems

arXiv:2508.02102 · eess.SY, cs.SY · Submitted 2025-08-04 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: Robotics Radio. Generated commentary on the latest robotics and control papers.

Rosa: We're looking at the paper: "Centralized Dynamic State Estimation Algorithm for Detecting and Distinguishing Faults and Cyber Attacks in Power Systems".

Dev: Here's the gist of the paper. The gist The study validates a centralized Dynamic State Estimation (DSE) algorithm designed to enhance the protection of power systems by systematically identifying and differentiating anomalies caused by cyberattacks from those resulting from physical faults in microgrids How it works The core of the proposed solution is a centralized Dynamic State Estimation (DSE) algorithm that utilizes a structured hypothesis testing framework to enhance anomaly detection The algorithm is built upon developing a high-fidelity model for the protection zone by constructing detailed mathematical representations for all devices like transmission lines and inverters The DSE-based algorithm then utilizes the WLS method to obtain parameter estimates by minimizing a sum of squared differences between actual measurements and their estimates, formalized in equation (3) The solution to this optimization problem is obtained via Newton’s iterative algorithm given by equation (4) A parameterized chi-square test is conducted to assess the consistency between measurements and the model, expressed in equation (6) The confidence level cl that measurements are consistent with the dynamic protection zone model is given by equation (7) Protection Scheme Methodology The overall protection algorithm begins with initialization, followed by gathering individual device models to define expected behaviors under normal conditions A model of the microgrid is constructed as a baseline for anomaly detection after which a counter is initialized to control data collection and analysis iterations Current and voltage measurements are gathered to form an initial measurement model, followed by DSE analysis based on the latest data The algorithm checks for convergence; if DSE does not converge, necessary updates are made to measurements and model Upon convergence, confidence levels are assessed; normal operation is indicated if above a predetermined threshold of 80% in this study If the confidence level falls below the threshold, the hypothesis testing module is triggered to determine whether anomaly stems from a fault or cyberattack Hypothesis Testing Module The hypothesis testing module is crucial for determining causes of anomalies by considering three distinct hypotheses 1) Cyberattack Hypothesis considers an attack affecting the measurement channel, and if confidence level after DSE exceeds a set threshold, it confirms a cyberattack 2) Fault Hypothesis if initial test is inconclusive, the hypothesis shifts to potential physical fault within the suspect protection zone 3) Combined Cyberattack and Fault Hypothesis when neither can be distinguished, this tests for simultaneous occurrence of both Validation Through Case Studies The proposed protection scheme was evaluated using a microgrid test system featuring multiple components like PV systems and BESS Four case studies were conducted, each simulated over a separate five-second interval with events beginning at 2 seconds and lasting for 2 seconds In Case 1 (Increased CT Ratio Cyberattack on MU54), a false data injection attack manipulated the CT ratio to 3:1, significantly increasing current measurements The algorithm responded by identifying and isolating affected measurement channels after re-running DSE, which promptly stabilized confidence level to near 100% In Case 2 (Single Line-to-Ground Fault), the algorithm refined the microgrid model by removing all measurements from the affected protection zone and adjusting related components In Case 3 (Increased CT Ratio Cyberattack and Fault), testing a third hypothesis confirmed simultaneous dual nature of disturbances, resulting in confidence level surging to nearly 100% Case 4 demonstrated that a decreased CT ratio attack extended decision time by reducing current signal, compromising quick response The study introduces a Centralized Dynamic State Estimation algorithm that effectively detects and differentiates between electrical faults and cyberattacks While the algorithm quickly detected attacks, it responded more slowly to decreased CT ratio attacks, suggesting areas for future optimization Future research should explore more complex scenarios such as FDIA involving dynamic injections of data packets or source code alterations to simulate gradual fluctuations in current measurements The paper concludes by confirming the algorithm's effectiveness in real-time environments through validation across various disturbance conditions The research underscores the critical role of advanced diagnostic tools for protection and control systems against cyber-physical threats How it works (Timing) Detection and decision-making depend on sampling rates, processing times, and user-defined delays; using 80 samples per cycle in a 60 Hz system results in a sampling period of 208 microseconds Decisions to alert or trip are made based on the area under the curve (1/cl(t)) exceeding a predefined threshold Td, set at 40 ms within a 100-ms moving reset window <ref:pg5, "Decisions to alert or trip are made based on the area under the curve

Paper summary: Rosa: So to go deeper into this paper, we see that the core thesis is using a centralized DSE algorithm to enhance protection for power systems, focusing specifically on microgrids that have substantial renewable energy integration. The central claim is its ability to systematically identify and differentiate anomalies caused by cyberattacks from those resulting from physical faults.

Dev: It achieves this by building a high-fidelity model of the protection zone, constructing detailed mathematical representations for everything in that area—things like transmission lines, inverters, and energy storage systems. This model helps align actual measurements with the expected behavior.

Taro: Before we get to the testing part, we need to understand how they build that initial model because it’s the foundation for everything else. They use a standard syntax where x(t), u(t), and i(t) represent states, controls, and interface currents of the model.

Rosa: Right. Once that high-fidelity model is built, the DSE algorithm uses a weighted least squares method to get parameter estimates by minimizing a sum of squared differences between what’s actually measured and what the model predicts, which is formalized in equation three <ref:2508.02102#pg3>.

Dev: And they solve that optimization problem using Newton’s iterative algorithm given by equation four. This gives them the best possible estimate of the system parameters under normal conditions.

Taro: Then they check how good those estimates are by running a parameterized chi-square test, which is equation six to see how consistent the measurements are with their model. The confidence level cl that measurements are consistent with that dynamic protection zone model is given by equation seven.

Rosa: So the overall process starts with initialization, then gathering individual device models for normal conditions to build a baseline microgrid model. Then they gather current and voltage measurements to form an initial measurement model, followed by DSE analysis based on the latest data.

Dev: They check for convergence during this DSE analysis; if it doesn't converge, they make necessary updates to both the measurements and the model. Once it converges, they assess those confidence levels. If it’s above a threshold of eighty percent in their study, normal operation is indicated.

Taro: If that confidence level drops below that threshold, then the hypothesis testing module kicks in to decide if the anomaly is a fault or a cyberattack. This is where they get specific about what they are looking for next.

Rosa: It’s interesting how they structure this decision process based on three distinct hypotheses: first, the Cyberattack Hypothesis considers an attack affecting the measurement channel, and if the confidence level after DSE exceeds a set threshold, it confirms a cyberattack.

Dev: If that initial test doesn't give a clear answer, then they shift to the Fault Hypothesis. This hypothesis tests for a potential physical fault within that suspect protection zone, isolating the zone and repeating DSE. A high confidence level here indicates a localized fault and triggers a power fault declaration.

Conclusion: Rosa: So looking at the whole picture of this Centralized Dynamic State Estimation Algorithm for Detecting and Distinguishing Faults and Cyber Attacks in Power Systems, the authors, Emad Abukhousa, Syed Sohail Feroz Syed Afroz, Fahad Alsaeed, Abdulaziz Qwbaiban, and A.P. Sakis Meliopoulos from Georgia Institute of Technology have shown something important about how we monitor these systems.

Dev: The implication is that we can move toward protection systems that don't just rely on fixed settings but instead use a dynamic model to continuously check the consistency of data against expected physics, which helps us catch things before they cause major outages.

Taro: What this means in simple terms is that if you have a weird spike in data, this algorithm tries to quickly tell you if it's a hacker messing with the sensor or if a physical wire just blew out. It’s about immediate, intelligent discrimination between those two things happening at once.

Rosa: And they did this by validating it across four specific challenging tests—FDIA via manipulated CT ratios, a single line-to-ground fault, and combined scenarios where both issues occur simultaneously. This shows the algorithm works in a real-world context with different types of disturbances.

Dev: The limitation they point out is that while it’s fast at detecting some attacks, like those manipulating current transformer ratios, it can be slower when dealing with a decreased CT ratio attack because the signal gets weaker.

Taro: So, to sum up what this paper offers for someone just listening to the show, it’s about developing a diagnostic tool that sits between the digital and physical layers of our power grid to proactively prevent failures caused by either source.

Rosa: That’s right. It shows that advanced diagnostic tools are essential for protecting power systems as we integrate more renewable energy sources and face these complex cyber-physical threats today.

Emad Abukhousa, Syed Sohail Feroz Syed Afroz, Fahad Alsaeed, Abdulaziz Qwbaiban, A.P. Sakis Meliopoulos

Georgia Institute of Technology

eess.SY, cs.SY

Submitted: 2025-08-04

Updated: 2025-08-04

Journal ref: 2025 IEEE Power & Energy Society General Meeting (PESGM)

DOI: 10.1109/PESGM52009.2025.11225641

License: http://creativecommons.org/licenses/by/4.0/

Importance score: 74/100

The gist: The gist The study validates a centralized Dynamic State Estimation (DSE) algorithm designed to enhance the protection of power systems by systematically identifying and differentiating anomalies

Key concepts

Dynamic State Estimation (DSE): This is a centralized algorithm that estimates the real-time state of a power system. It uses measurements from various devices and constructs detailed mathematical models to figure out what the system is doing moment by moment. This allows the algorithm to detect inconsistencies or anomalies in the data, which can signal a problem.
Hypothesis Testing Framework: This structured method is used after DSE detects an anomaly. It systematically tests three distinct possibilities: whether the anomaly is caused by a cyberattack, a physical fault, or both occurring simultaneously. This helps precisely determine the root cause of any detected disturbance.
False Data Injection Attack (FDIA): This specific cyberattack involves manipulating sensor data, such as changing Current Transformer (CT) ratios. The attacker feeds incorrect measurements into the system to trick the protection relays into making wrong decisions. The algorithm is designed to detect these manipulated measurements by comparing them against the expected physical model.
Confidence Level ($cl$): The confidence level measures how consistent the actual measurements are with the mathematical model of a healthy system. If this level stays above 80%, normal operation is assumed. A drop below this threshold triggers the hypothesis testing module to investigate whether a fault or cyberattack is responsible.

Terminology

Diagnostic Tools — 1× in this paper · explained in 2 episodes
Transformer — 1× in this paper · explained in 2 episodes

Summary

The gist The study validates a centralized Dynamic State Estimation (DSE) algorithm designed to enhance the protection of power systems by systematically identifying and differentiating anomalies caused by cyberattacks from those resulting from physical faults in microgrids

How it works

The core of the proposed solution is a centralized Dynamic State Estimation (DSE) algorithm that utilizes a structured hypothesis testing framework to enhance anomaly detection The algorithm is built upon developing a high-fidelity model for the protection zone by constructing detailed mathematical representations for all devices like transmission lines and inverters The DSE-based algorithm then utilizes the WLS method to obtain parameter estimates by minimizing a sum of squared differences between actual measurements and their estimates, formalized in equation (3) The solution to this optimization problem is obtained via Newton’s iterative algorithm given by equation (4) A parameterized chi-square test is conducted to assess the consistency between measurements and the model, expressed in equation (6) The confidence level cl that measurements are consistent with the dynamic protection zone model is given by equation (7)

Protection Scheme Methodology

The overall protection algorithm begins with initialization, followed by gathering individual device models to define expected behaviors under normal conditions A model of the microgrid is constructed as a baseline for anomaly detection after which a counter is initialized to control data collection and analysis iterations Current and voltage measurements are gathered to form an initial measurement model, followed by DSE analysis based on the latest data The algorithm checks for convergence; if DSE does not converge, necessary updates are made to measurements and model Upon convergence, confidence levels are assessed; normal operation is indicated if above a predetermined threshold of 80% in this study If the confidence level falls below the threshold, the hypothesis testing module is triggered to determine whether anomaly stems from a fault or cyberattack

Hypothesis Testing Module

The hypothesis testing module is crucial for determining causes of anomalies by considering three distinct hypotheses 1) Cyberattack Hypothesis considers an attack affecting the measurement channel, and if confidence level after DSE exceeds a set threshold, it confirms a cyberattack 2) Fault Hypothesis if initial test is inconclusive, the hypothesis shifts to potential physical fault within the suspect protection zone 3) Combined Cyberattack and Fault Hypothesis when neither can be distinguished, this tests for simultaneous occurrence of both

Validation Through Case Studies

The proposed protection scheme was evaluated using a microgrid test system featuring multiple components like PV systems and BESS Four case studies were conducted, each simulated over a separate five-second interval with events beginning at 2 seconds and lasting for 2 seconds In Case 1 (Increased CT Ratio Cyberattack on MU54), a false data injection attack manipulated the CT ratio to 3:1, significantly increasing current measurements The algorithm responded by identifying and isolating affected measurement channels after re-running DSE, which promptly stabilized confidence level to near 100% In Case 2 (Single Line-to-Ground Fault), the algorithm refined the microgrid model by removing all measurements from the affected protection zone and adjusting related components In Case 3 (Increased CT Ratio Cyberattack and Fault), testing a third hypothesis confirmed simultaneous dual nature of disturbances, resulting in confidence level surging to nearly 100% Case 4 demonstrated that a decreased CT ratio attack extended decision time by reducing current signal, compromising quick response

Conclusion and Future Work

The study introduces a Centralized Dynamic State Estimation algorithm that effectively detects and differentiates between electrical faults and cyberattacks While the algorithm quickly detected attacks, it responded more slowly to decreased CT ratio attacks, suggesting areas for future optimization Future research should explore more complex scenarios such as FDIA involving dynamic injections of data packets or source code alterations to simulate gradual fluctuations in current measurements The paper concludes by confirming the algorithm's effectiveness in real-time environments through validation across various disturbance conditions The research underscores the critical role of advanced diagnostic tools for protection and control systems against cyber-physical threats

How it works (Timing)

Detection and decision-making depend on sampling rates, processing times, and user-defined delays; using 80 samples per cycle in a 60 Hz system results in a sampling period of 208 microseconds Decisions to alert or trip are made based on the area under the curve (1/cl(t)) exceeding a predefined threshold Td, set at 40 ms within a 100-ms moving reset window <ref:pg5, "Decisions to alert or trip are made based on the area under the curve

Improvements for AI systems

Improve anomaly detection by integrating a dynamic model that includes inverter-based resources such as inverters and energy storage systems within a high-fidelity protection zone model. This allows for more accurate alignment of actual measurements with expected behavior, enhancing resilience against variations in sources, faults, and loads.
Enhance cyberattack identification by systematically applying the hypothesis testing module after the Dynamic State Estimation (DSE) confirms an anomaly. This framework allows the system to differentiate between cyber-induced anomalies and physical faults, directly addressing the literature gap of clearly distinguishing between them in microgrids with IBRs and DERs.
Improve real-time response speed by optimizing the decision criteria based on the area under the curve (1/l - c t) exceeding a threshold Td, set at 40 ms within a 100-ms moving reset window. This specific timing mechanism ensures that trip or alert signals are issued quickly, as demonstrated by the study's findings of 2.8 ms for faults in Case Study 3.
Increase detection sensitivity during measurement degradation by incorporating variable CT ratio attack detection into the hypothesis testing module. This allows the system to specifically identify and trigger alerts when attacks dynamically change over time, mimicking normal operational fluctuations, preventing response delays seen in Case 4.

Abstract

As power systems evolve with increased integration of renewable energy sources, they become more complex and vulnerable to both cyber and physical threats. This study validates a centralized Dynamic State Estimation (DSE) algorithm designed to enhance the protection of power systems, particularly focusing on microgrids with substantial renewable energy integration. The algorithm utilizing a structured hypothesis testing framework, systematically identifies and differentiates anomalies caused by cyberattacks from those resulting from physical faults. This algorithm was evaluated through four case studies: a False Data Injection Attack (FDIA) via manipulation of Current Transformer (CT) ratios, a single line-to-ground (SLG) fault, and two combined scenarios involving both anomalies. Results from real-time simulations demonstrate that the algorithm effectively distinguishes between cyber-induced anomalies and physical faults, thereby significantly enhancing the reliability and security of energy systems. This research underscores the critical role of advanced diagnostic tools in protecting power systems against the growing prevalence of cyber-physical threats, enhancing the resilience of the grid and preventing potential blackouts by avoiding the mis-operation of protection relays.