Modeling and Evaluation of False Data Injection Attacks (FDIA) in DER Inverters

Solar inverters are susceptible to cyber attacks and thus affecting grid stability. This paper presents the development and evaluation of false data injection attack (FDIA) models, designed to enhance the cybersecurity of DER, in solar inverters. Real-time frequency data from two Fronius (Primo 15.0-1 208–240) single-phase solar inverters were used in developing the FDIA models on frequency parameters. Three versions of anomalous data patterns <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$(V_{1}-V_{3})$</tex> and five signatures <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$(S_{1}-S_{5})$</tex>, resulting in the generation of 15 different datasets with unique patterns were analyzed. Mathematical functions such as, gaussian, sigmoid, pulse, sinusoidal and polynomial were used to model randomness and stealthiness of FDIA. Detection analysis was performed to evaluate the stealthiness of each signature using four different machine learning (ML) models: Isolation Forest (IF), Local Outlier Factor (LOF), Elliptic Envelope (EE), and One-Class Support Vector Machine (OC-SVM). The results indicate that the version with anomalies of varying duration in random instances <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$(V_{3})$</tex> was the most challenging to detect, with F1 scores ranging between 0.425 and 0.76, while the version with continuous 3-hours of anomaly each day <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$(V_{1})$</tex> was the most detectable by all ML models, where EE and IF achieved higher F1 scores of 0.895 and 0.890, respectively. These data sets will help to further develop robust anomaly detection mechanisms for safeguarding DER systems against cyber threats, thereby enhancing the resilience and reliability of modern power grids.