Cyber-Resilient System Identification for Power Grid through Bayesian Integration

TL;DR

This work addresses the fragility of snapshot-based grid state and topology estimation under cyber threats by introducing a Bayesian integration that fuses robust snapshot-based identification with a distance-based time-series prior learned from historical, non-IID data. The method extends ckt-GSE to bus-branch models and augments it with a temporal prior via DynWatch-like weighting, enabling resilient detection of random errors and targeted FDIA while preserving near-linear scalability. Key results show over 70% reduction in estimation error under FDIA, accurate anomaly detection and localization, and runtimes under 1 minute per tick on large networks using a laptop. The approach offers a practical path to cyber-resilient situational awareness for large-scale power grids using hybrid SCADA-PMU data and historically informed priors.

Abstract

Power grids increasingly need real-time situational awareness under the ever-evolving cyberthreat landscape. Advances in snapshot-based system identification approaches have enabled accurately estimating states and topology from a snapshot of measurement data, under random bad data and topology errors. However, modern interactive, targeted false data can stay undetectable to these methods, and significantly compromise estimation accuracy. This work advances system identification that combines snapshot-based method with time-series model via Bayesian Integration, to advance cyber resiliency against both random and targeted false data. Using a distance-based time-series model, this work can leverage historical data of different distributions induced by changes in grid topology and other settings. The normal system behavior captured from historical data is integrated into system identification through a Bayesian treatment, to make solutions robust to targeted false data. We experiment on mixed random anomalies (bad data, topology error) and targeted false data injection attack (FDIA) to demonstrate our method's 1) cyber resilience: achieving over 70% reduction in estimation error under FDIA; 2) anomalous data identification: being able to alarm and locate anomalous data; 3) almost linear scalability: achieving comparable speed with the snapshot-based baseline, both taking <1min per time tick on the large 2,383-bus system using a laptop CPU.

Figures (8)

• Figure 1: Generalized state estimation on bus-branch model: (a) at any time $t$, given a power grid that is measured by SCADA and modern PMUs, the grey dashed transmission line is inactive; (b) if it is a bus-branch model, we add pseudo buses and pseudo circuit breakers, in order to estimate topology; the breaker statuses represent the associated line statuses, i.e., an active line connects to a closed breaker and an inactive line connects to an open breaker; (c) the measured elements are replaced with equivalent circuit models (PMU model, RTU model, and open/closed switch model, as developed in ckt-GSESUGAR-SE-LiconvexSE-LAV-Li) to transform the power grid into an aggregated linear equivalent circuit on which the independent current sources $n_{pmu}, n_{rtu}, n_{sw}$ capture data errors and they are to be solved by minimization. The RTU model has $G_{rtu}=\frac{P_{rtu}}{|V|_{rtu}^2}; B_{rtu}=-\frac{Q_{rtu}}{|V|_{rtu}^2}$.
• Figure 2: Bayesian Network: The system starts from an initial state (vector) $\bm{x}^{(0)}$ which includes the AC bus voltages $\bm{v^}{(0)}$ and network topology $G^{(0)}$. At any time $t$, control action $\bm{u^}{(t)}$ and stochastic process drive the system to change from $\bm{x}^{(t-1)}$ to new state $\bm{x}^{(t)}$; sensors collect real-time data (vector) $\bm{z^}{(t)}$; and anomalies $\bm{a^}{(t)}$ can affect the system's state and/or its data. Gaining situation awareness is to infer the unknown variables $\bm{x,a}$ given the known or observed variables $\bm{z,u}$.
• Figure 3: Anomaly detection on 30-bus system: bars plot the magnitude of $\bm{n}$. Top: Time-series measurements on case30: (a subset of the 600 time ticks). Bottom: random bad data are detectable by $|\bm{n}_{pmu}|,|\bm{n}_{rtu}|$ from ckt-GSE; topology errors are detectable by $|\bm{n}_{sw}|$ from ckt-GSE; targeted false data injected by FDIA are detectable by $|\bm{n}|$ from augmented ckt-GSE. These different anomalous data are distinguishable from a combined used of ckt-GSE and augmented ckt-GSE in this work. See Figure \ref{['fig: 1354pegase AD']} for detection on 1354-bus system.
• Figure 4: Anomaly localization on 30-bus system: baseline ckt-GSE locates the random bad data and topology errors; but fails to recognize FDIA. The proposed method identifies all of these threats. See Figure \ref{['fig: 1354pegase AD']} for result on 1354-bus system.
• Figure 5: Estimation robustness: Under FDIA, the augmented ckt-GSE significantly reduces estimation error, mitigating the adversary’s intended impact. But this comes with slightly lower accuracy under normal or random error conditions. The combined use of two estimators can address this: when large $\bm{n}$ from augmented ckt-GSE indicates targeted high penetration of false data, augmented ckt-GSE should be trusted; otherwise, baseline ckt-GSE provides the most accurate estimate.

Theorems & Definitions (1)

• definition 1: augmented ckt-GSE with state prior