Distinguishing Between Cyber Attacks and Faults in Power Electronic Systems—A Noninvasive Approach

With the increased cyberinfrastructure in large power systems with inverter-based resources (IBRs), it remains highly susceptible to cyber-attacks. Reliable and secure operations of such a system under a large signal disturbance necessitate an anomaly diagnosis scheme, which is substantial for either selective operation of relays (during grid faults) or cybersecurity (during cyber-attacks). This becomes a challenge for power electronic systems, as their characteristic response to such large-signal disturbances is very fast. Hence, we accumulate our efforts in this article to characterize them accurately within a short time frame. A novel noninvasive anomaly diagnosis mechanism for IBRs is presented, which only requires locally measured voltage and frequency as inputs. Mapping these inputs in a <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$XY$ </tex-math></inline-formula> -plane, the characterization process is able to classify between the anomalies within 5 ms. To the best of our knowledge, this mechanism provides the fastest decision in comparison to the existing techniques, which also assists the equipped protection/cybersecurity technology to take corresponding decisions without enforcing any customization. The proposed scheme is validated on many systems using real-time (RT) simulations in OPAL-RT environment with HYPERSIM software and also on a hardware prototype. The results verify the effectiveness, scalability, and accuracy of the proposed mechanism under different scenarios.