An evaluation of methods for detecting false data injection attacks in the smart grid

With the introduction of new Information and Communication Technology (ICT) to Electrical Power Systems (EPSs) there is an increased potential and impact of cyber-attacks. Phasor Measurement Units (PMUs) enable very fine granular measurements to allow situational awareness in smart grids. But false data injection attacks, which manipulate measurement data, can trigger wrong decisions and cause critical situations in the grid. In this paper, we analyze four different false data injection attacks on PMU measurements and investigate different methods to detect such attacks. Classical bad data detection methods are not sufficient to detect stealthy attacks. We therefore propose to complement detection by additional methods. For this we analyze the detection performance of four very different detection methods: (a) the classical adaptive bad data detection approach based on the residuals of linear Kalman Filters, (b) a simple threshold based on the Median Average Deviation (MAD), (c) a distribution-based approach using the Kullback-Leibler Divergence (KLD), and (d) the cumulative sum (CUSUM) as a representative of a change point detection method. We show that each method has advantages and disadvantages and that multiple methods should be used together to prevent that attackers can circumvent detection.