Methods and system for detecting false data injection attacks

Patent metadata

Field	Value
Publication number	US-2018024900-A1
Application number	US-201615218822-A
Country	US
Kind code	A1
Filing date	Jul 25, 2016
Priority date	Jul 25, 2016
Publication date	Jan 25, 2018
Grant date	—

Abstract

A system for detecting false data injection attacks includes one or more sensors configured to each monitor a component and generate signals representing measurement data associated with the component. The system also includes a fault detection computer device configured to: receive the signals representing measurement data from the one or more sensors, receive a fault indication of a fault associated with the component, generate a profile for the component based on the measurement data, and determine an accuracy of the fault indication based upon the generated profile.

First claim

What is claimed is:

1 . A system for detecting false data injection attacks, said system comprising:
one or more sensors configured to monitor a component and generate signals representing measurement data associated with the component; and a fault detection computer device comprising a processor and a memory coupled to said processor, said fault detection computer device in communication with said one or more sensors, said fault detection computer device configured to:
receive the signals representing measurement data from the one or more sensors;
receive a fault indication of a fault associated with the component;
generate a profile for the component based on the measurement data; and
determine an accuracy of the fault indication based upon the generated profile.

2 . The system in accordance with claim 1 , wherein said fault detection computer device is further configured to:
store a plurality of profiles corresponding to a plurality of faults; compare the generated profile with the stored plurality of profiles; and determine the accuracy of the fault indication based on the comparison.

3 . The system in accordance with claim 2 , wherein said fault detection computer device is further configured to determine at least one potential sensor error based on the comparison.

4 . The system in accordance with claim 3 , wherein said fault detection computer device is further configured to issue a maintenance request based on the at least one potential sensor error.

5 . The system in accordance with claim 1 , wherein said one or more sensors comprise a first sensor and a second sensor, and wherein said fault detection computer device is further configured to:
receive signals from said first sensor and said second sensor, wherein said first sensor is proximate to the component and said second sensor is a distance from said first sensor; determine a first profile based on the signals from said first sensor; determine a second profile based on the signals from said second sensor; and compare the first profile to the second profile based on the distance between said first sensor and said second sensor.

6 . The system in accordance with claim 1 , wherein the profile includes a total harmonic distortion of the signals of said one or more sensors.

7 . The system in accordance with claim 1 , wherein the profile includes a total harmonic distortion of the signals of said one or more sensors over a period of time prior to the fault and a period of time after the fault.

8 . The system in accordance with claim 1 , wherein said fault detection computer device is further configured to determine a potential cyber-attack based on the accuracy of the fault indication.

9 . The system in accordance with claim 1 , wherein the component is at least one of a substation load tap changer, a substation voltage regulator, a line voltage regulator, a capacitor bank, a single-phase transformer, a multi-phase transformer, and a customer meter.

10 . The system in accordance with claim 1 , wherein said fault detection computer device is further configured to disable the component based at least in part on the accuracy of the fault indication.

11 . The system in accordance with claim 1 , wherein said fault detection computer device is further configured to at least one of disable and ignore output from at least one of the sensors of the one or more sensors based at least in part on the accuracy of the fault indication.

12 . A computer-based method for detecting false data injection attacks, said method implemented using a fault detection computer device including at least one processor in communication with a memory, said method comprising:
receiving signals representing measurement data from the one or more sensors that monitor a component and generate signals representing the measurement data associated with the component; receiving a fault indication of a fault associated with the component; generating a profile for the component based on the measurement data; and determining an accuracy of the fault indication based upon the generated profile.

13 . The method in accordance with claim 12 , further comprising:
storing a plurality of profiles corresponding to a plurality of faults; comparing the generated profile with the stored plurality of profiles; and determining the accuracy of the fault indication based on the comparison.

14 . The method in accordance with claim 13 , further comprising determining at least one potential sensor error based on the comparison.

15 . The method in accordance with claim 12 , further comprising:
receiving signals from a first sensor and a second sensor of the one or more sensors, wherein the first sensor is proximate to the component and the second sensor is a distance from the first sensor; determining a first profile based on the signals from the first sensor; determining a second profile based on the signals from the second sensor; and comparing the first profile to the second profile based on the distance between the first sensor and the second sensor.

16 . The method in accordance with claim 12 , wherein the profile includes a total harmonic distortion of the signals of the one or more sensors.

17 . The method in accordance with claim 12 , wherein the profile includes a total harmonic distortion of the signals of the one or more sensors over a period of time prior to and a period of time after the fault.

18 . The method in accordance with claim 12 , further comprising determining a potential cyber-attack based on the accuracy of the fault indication.

19 . A computer-readable storage device having processor-executable instructions embodied thereon, for detecting false data injection attacks, wherein when executed by a fault detection computer device communicatively coupled to a memory, the processor-executable instructions cause the fault detection computer device to:
receive signals representing measurement data from the one or more sensors that monitor a component and generate signals representing the measurement data associated with the component; receive a fault indication of a fault associated with the component; generate a profile for the component based on the measurement data; and determine an accuracy of the fault indication based upon the generated profile.

20 . The computer readable storage device of claim 19 , wherein the processor-executable instructions cause the fault detection computer device to:
store a plurality of profiles corresponding to a plurality of faults; compare the generated profile with the stored plurality of profiles; and determine the accuracy of the fault indication based on the comparison.

Assignees

• Gen Electric

Inventors

• Premerlani William James
• Baone Chaitanya Ashok
• Pan Yan

Classifications

• G06F11/2215

  to test error correction or detection circuits · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• G06F11/2221 Primary

  to test input/output devices or peripheral units · CPC title

• G06F11/327

  Alarm or error message display · CPC title

• G06F11/3672

  Test management · CPC title