Coordinated Cyberattack Detection in a Partially Observable Power Distribution System

The integration of grid-edge devices in power distribution systems requires advanced monitoring and remote control which is enabled by a coupled cyber-physical system. This increases system vulnerability and makes it prone to cyberattacks. Strategic coordination of multiple cyberattacks, i.e., coordinated cyberattacks can cause prominent damage to the system operations. Detection of coordinated cyberattacks in the cyber layer ensures the protection of the physical power system from the impact of these attacks. Along with efficient attack detection in a fully observable system, the detection mechanism should have the capability to detect coordinated attacks when the system is not fully observable. An intelligent online detection solution is proposed in this paper for detecting the objective of a coordinated cyber attack sequence and predicting the attack trajectory in a partially observable distribution network with uncertainties. The detection algorithm learns attack patterns which is formulated as a fuzzy logic-based Partially Observable Markov Decision Process. The detection performance of the algorithm is validated on an IEEE 13-node feeder.