Technologies for detecting cyber-attacks against electrical distribution devices

Patent metadata

Field	Value
Publication number	US-11943236-B2
Application number	US-201815963850-A
Country	US
Kind code	B2
Filing date	Apr 26, 2018
Priority date	Apr 26, 2018
Publication date	Mar 26, 2024
Grant date	Mar 26, 2024

Abstract

Technologies for detecting cyber-attacks against electrical distribution devices include a controller. The controller includes circuitry to determine a first measured value of a first operational parameter of a transformer based upon one or more signals received from one or more sensors of the transformer. The circuitry is also to determine a second measured value of a second operational parameter of the transformer based upon one or more signals received from the one or more sensors of the transformer, calculate a first expected value of the first operational parameter based on the second measured value of the second operational parameter and a model of the transformer that relates the first and second operational parameters, compare the first measured value of the first operational parameter to the first expected value of the first operational parameter, and identify when a difference between the first measured value and the first expected value exceeds a first threshold.

First claim

The invention claimed is:

1. A method for securing a transformer, the method comprising:
determining, by a controller of the transformer, a plurality of measured values of a first operational parameter of the transformer based upon one or more signals received from one or more sensors of the transformer, the first operational parameter comprising a temperature associated with the transformer, the plurality of measured values comprising a first measured value;
comparing the plurality of measured values to each other;
determining, by the controller based on the comparison, whether the plurality of measured values have stabilized to a predefined load condition;
determining, by the controller, a second measured value of a second operational parameter of the transformer based upon one or more signals received from the one or more sensors of the transformer;
calculating, by the controller, a first expected value of the first operational parameter in response to a determination that that the plurality of measured values have stabilized to the predefined load condition, wherein the calculating is based on the second measured value of the second operational parameter and a model of the transformer that relates the first and second operational parameters;
comparing, by the controller, the first measured value of the first operational parameter to the first expected value of the first operational parameter;
determining, by the controller, a residual value indicative of an effect of noise on a measurement of at least one of the first and second operational parameters of the transformer;
determining, by the controller, whether the residual value is within a predefined upper bound and a predefined lower bound;
identifying, by the controller, that the transformer is subject to a cyber attack when:
a difference between the first measured value and the first expected value exceeds a first threshold, and
the residual value is not within the predefined upper bound and the predefined lower bound;

calculating, by the controller, an expected oil characteristic temperature from at least one of an ambient temperature, an oil temperature from a top of a tank, or an oil temperature from a bottom of the tank;
calculating, by the controller, an expected hot spot characteristic temperature from the at least one of the ambient temperature, the oil temperature from the top of the tank, or the oil temperature from the bottom of the tank;
calculating, by the controller, expected power total loss conditions at the expected hot spot characteristic temperature;
comparing, by the controller, an expected power balance and an expected power total loss;
determining, by the controller, whether the difference between the expected power balance and the expected power total loss exceeds a predetermined threshold; and
executing a corrective action in response to a determination that the difference between the expected power balance and the expected power total loss exceed the predetermined threshold to mitigate an effect of the difference between the expected power balance and the expected power total loss, the corrective action comprising at least one of adjusting a tap changer setting of the transformer and deactivating the transformer in response to the determination that the difference between the expected power balance and the expected power total loss exceed the predetermined threshold.

2. The method of claim 1 , further comprising performing a responsive action in response to identifying that the transformer is subject to a cyber attack when the difference between the first measured value and the first expected value exceeds the first threshold.

3. The method of claim 2 , wherein performing the responsive action comprises generating a notification to a user interface that there is an error between the first measured value and the first expected value and that the residual value is not within the predefined upper bound and the predefined lower bound.

4. The method of claim 2 , wherein performing the responsive action comprises executing a corrective action to mitigate effects that the difference between the first measured value and the first expected value has on performance of the transformer.

5. The method of claim 1 , wherein the second measured value comprises at least one of a current, a voltage, or a temperature.

6. The method of claim 1 , wherein comparing the first measured value to the first expected value comprises comparing the first measured value to the first expected value over a time interval.

7. The method of claim 1 , wherein determining whether the plurality of measured values have stabilized to the predefined load condition further comprises:
calculating a rate of change of the plurality of measured values; and
determining, based on the calculation, whether the rate of change of the operational parameter is below a predefined threshold.

8. The method of claim 1 , wherein the plurality of measured values comprise at least one of an oil temperature from a top of a tank or an oil temperature from a bottom of the tank from the one or more sensors, and the second measured value comprises a load current from the one or more sensors.

9. The method of claim 1 , wherein the plurality of measured values comprise an ambient temperature from the one or more sensors.

10. The method of claim 1 , wherein calculating the first expected value comprises calculating a coolant fluid temperature parameter corresponding to a hotspot temperature based on at least one of a second measured value, a type of the coolant fluid, or physical parameters of the transformer.

11. The method of claim 1 , further comprising adjusting the first expected value for harmonic loss contribution in response to a determination that the harmonic distortion is greater than a predetermined threshold.

12. The method of claim 1 , wherein calculating the first expected value further comprises calculating real time load losses based on at least one of load losses, eddy current losses, or stray losses, wherein the load losses are a function of temperature dependent winding resistance, and wherein the eddy current losses and stray losses are a function of a harmonic loss coefficient.

13. The method of claim 12 , wherein comparing the first measured value to the first expected value comprises comparing a measured proportionality of input and output power and the real time load losses.

14. The method of claim 1 , wherein calculating the first expected value comprises calculating an expected power balance from an input bus and an output bus.

15. The method of claim 1 , wherein determining whether the plurality of measured values have stabilized to the predefined load condition further comprises:
calculating a variance of the plurality of measured values; and
determining, based on the calculation, whether the variance of the operational parameter is within a predefined range.

16. The method of claim 1 , wherein determining whether the plurality of measured values have stabilized to a predefined load condition further comprises determining whether the plurality of measured values vary by 4 degrees C. or less.

17. A controller for securing a transformer, the controller comprising:
circuitry to:
determine a plurality of measured values of a first operational parameter of the transformer based upon one or more signals received from one or more sensors of the transformer, the first operational parameter comprising a temperature associated with the transformer, the plurality of measured values comprising at least one of an oil temperature f

Assignees

• Hitachi Energy Ltd

Inventors

• Nuqui Reynaldo
• Hong Junho
• Coats David

Classifications

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• G05B19/0428

  Safety, monitoring (G05B19/0423 takes precedence) · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G05B23/0254

  based on a quantitative model, e.g. mathematical relationships between inputs and outputs; functions: observer, Kalman filter, residual calculation, Neural Networks · CPC title