Anomaly detection method for cyber physical power system based on bilateral data fusion

• A composite anomaly detection model based on cyber-physical bilateral data is established. • Precisely matching feature extraction models based on the distinctive attributes of bilateral data. • Implements deep cross-domain features fusion to link evolving cyber behaviors with physical disruptions. The localized faults are easier to propagate across domains and escalate into cascading failures in cyber physical power system (CPPS) with the deep integration of cyber and physical components. As a result, the risks of CPPS have increased significantly. It is a challenge to fully quantify the complex characteristics of CPPS. A cyber-physical bilateral data-driven composite model is proposed in this paper to achieve efficient and accurate anomaly detection of CPPS. The novel model can depict data decomposition and feature extraction from both cyber and physical domains. First, a sample convolution and interaction network is built to effectively capture temporal dependencies and sudden anomaly features in physical-side data. The time-sensitive patterns and unique deviations are focused on ensuring accurate detection of physical-side anomalies. Second, a transformer-based detection model is established to extract dynamic network attributes and state transition patterns in cyber-side data. By accurately tracking evolving network behaviors and subtle state transitions, robust detection of anomalies in the cyber domain is ensured. Last, the extracted features from both cyber and physical domains are integrated into a unified representation to achieve cross-domain synergy to precisely map CPPS anomalies. Case studies on the IEEE 33-bus system validate the effectiveness and superior performance of proposed method in identifying diverse anomaly states and enhancing CPPS operational safety and stability.