Long Short-Term Memory-Based Approach for Ensuring Cyber-Security in Grid-Forming Inverters

Grid-forming inverters (GFMIs) have significantly improved power system reliability and stability by integrating renewable energy sources as voltage sources. Unlike grid-following inverters, which require an external power source for synchronization, GFMIs operate independently by using internally generated reference signals to regulate voltage and frequency, enabling stable operation even in islanding mode. However, since they primarily depend on reference signals, manipulating these signals can lead to grid instability. While some studies have explored anomaly and cyber-attack detection in conventional power systems, the cybersecurity of GFMIs remains insufficiently addressed, leaving critical vulnerabilities that could disrupt their operation (e.g., power generation shutdown, frequency oscillation). As cyber-attack techniques advance, these gaps pose significant risks in the transition toward carbon neutrality. This work proposes a novel anomaly classification framework using long short-term memory (LSTM) to address the cybersecurity challenges of GFMIs, focusing on false data injection attacks, denial of service attacks, hijacking attacks, and short-circuit faults. The model classifies inverter operational states and detects potential anomalies based on measurement signals at the point of common coupling. Contrastive case studies conducted in MATLAB/Simulink (Registered trademark) demonstrate the effectiveness of the proposed method, achieving 90% accuracy in anomaly detection and classification, leading to precise deployment of countermeasures. Implementing this approach in GFMIs ensuresmaximum renewable energy integration with resilience and enhances grid security, supporting a safer transition to a carbon-neutral future.