Cyber-Resilient Fault Diagnosis in Transmission Lines: A Substitute for Distance Relays Under Cyber-Attacks

The integration of digital technologies in substations—particularly communication protocols such as IEC 61850—improves operational efficiency and interoperability. However, it also introduces cyber-vulnerabilities that threaten data integrity and undermine the reliability of critical protection devices, such as distance relays, which are essential for maintaining system stability. To address this challenge, this paper proposes a cyber-resilient protection scheme that activates in response to cyber-attacks. This scheme, which serves as a temporary substitute for distance relays until the cyber-threat is mitigated, safeguards system security and stability under cyber-attacks. The proposed protection scheme mimics the zone-based fault detection of distance relays but leverages traveling waves (TWs)—which are the natural signatures of real faults—along with dedicated hard-wired current measurements and a Random Forest (RF) classifier to identify faults in each zone. The RF classifier is trained on the attenuation patterns of TW frequency components as they propagate from fault locations to the line terminal. Since attenuation patterns depend on both frequency and travel distance, the RF classifier can accurately determine the fault zone by extracting frequency-related features from the first TW using a wavelet transform and analyzing its attenuation characteristics. Simulation studies conducted on the IEEE 39-bus system demonstrate that the RF classifier achieves 99.56% accuracy in fault zone classification, while the entire scheme operates with a computational inference time of 0.18 ms, satisfying the real-time constraints of digital protection systems. These results confirm the effectiveness of the proposed method in maintaining reliable line protection under cyber-threat conditions.