Methods and system for detecting false data injection attacks

• US 10,372,569 B2
• Filed: 07/25/2016
• Issued: 08/06/2019
• Est. Priority Date: 07/25/2016
• Status: Active Grant

• Current Assignee: GE Digital Holdings LLC (GE Vernova, Inc.)
• Original Assignee: General Electric Company
• Inventors: Premerlani, William James, Baone, Chaitanya Ashok, Pan, Yan
• Primary Examiner(s): Shaw, Brian F
• Application Number:
  US15/218,822
• Publication Number:
  US 20180024900A1
• Time in Patent Office: 1,107 Days
• CPC Class Codes: G05B 23/0227 Qualitative history assessment, whereby the type of data acted upon, e.g. waveforms, images or patterns, is not relevant, e.g. rule based assessment; if-then decisions
• CPC Class Codes: G06F 11/2215 to test error correction or detection circuits
• CPC Class Codes: G06F 11/2221 to test input/output devices or peripheral units
• CPC Class Codes: G06F 11/327 Alarm or error message display
• CPC Class Codes: G06F 11/3672 Test management
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: Y04S 40/18 Network protocols supporting networked applications, e.g. including control of end-device applications over a network
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

A system for detecting false data injection attacks includes one or more sensors configured to each monitor a component and generate signals representing measurement data associated with the component. The system also includes a fault detection computer device configured to: receive the signals representing measurement data from the one or more sensors, receive a fault indication of a fault associated with the component, generate a profile for the component based on the measurement data, and determine an accuracy of the fault indication based upon the generated profile.

Claims

1. A system for detecting false data injection attacks, said system comprising:

one or more sensors configured to monitor a component and generate signals representing measurement data associated with the component, wherein said one or more sensors comprise a first sensor and a second sensor; and

a fault detection computer device comprising a processor and a memory coupled to said processor, said fault detection computer device in communication with said one or more sensors, said fault detection computer device configured to;

receive the signals representing measurement data from the one or more sensors;

receive signals from said first sensor and said second sensor, wherein said first sensor is proximate to the component and said second sensor is a distance from said first sensor;

receive a fault indication of a fault associated with the component;

generate a component profile for the component based on the measurement data;

determine a first profile based on the signals from said first sensor;

determine a second profile based on the signals from said second sensor;

compare the first profile to the second profile based on the distance between said first sensor and said second sensor; and

determine an accuracy of the fault indication based upon the generated component profile and the comparison.

2. The system in accordance with claim 1, wherein said fault detection computer device is further configured to:

store a plurality of profiles corresponding to a plurality of faults; and

compare the generated component profile with the stored plurality of profiles;

wherein the determination of the accuracy of the fault indication is further based on the comparison of the generated component profile with the stored plurality of profiles.

3. The system in accordance with claim 2, wherein said fault detection computer device is further configured to determine at least one potential sensor error based on the comparison of the generated component profile with the stored plurality of profiles.

4. The system in accordance with claim 3, wherein said fault detection computer device is further configured to issue a maintenance request based on the at least one potential sensor error.

5. The system in accordance with claim 1, wherein the generated component profile includes a total harmonic distortion of the signals of said one or more sensors.

6. The system in accordance with claim 1, wherein the generated component profile includes a total harmonic distortion of the signals of said one or more sensors over a period of time prior to the fault and a period of time after the fault.

7. The system in accordance with claim 1, wherein said fault detection computer device is further configured to determine a potential cyber-attack based on the accuracy of the fault indication.

8. The system in accordance with claim 1, wherein the component is at least one of a substation load tap changer, a substation voltage regulator, a line voltage regulator, a capacitor bank, a single-phase transformer, a multi-phase transformer, and a customer meter.

9. The system in accordance with claim 1, wherein said fault detection computer device is further configured to disable the component based at least in part on the accuracy of the fault indication.

10. The system in accordance with claim 1, wherein said fault detection computer device is further configured to at least one of disable and ignore an output from at least one of the sensors of the one or more sensors based at least in part on the accuracy of the fault indication.

11. A computer-based method for detecting false data injection attacks, said method implemented using a fault detection computer device including at least one processor in communication with a memory, said method comprising:

receiving signals representing measurement data from the one or more sensors that monitor a component and generate signals representing the measurement data associated with the component;

receiving signals from a first sensor and a second sensor of the one or more sensors, wherein the

first sensor is proximate to the component and the second sensor is a distance from the first sensor;

receiving a fault indication of a fault associated with the component;

generating a component profile for the component based on the measurement data;

determining a first profile based on the signals from the first sensor;

determining a second profile based on the signals from the second sensor;

comparing the first profile to the second profile based on the distance between the first sensor and the second sensor; and

determining an accuracy of the fault indication based upon the generated component profile and the comparing.

12. The method in accordance with claim 11, further comprising:

storing a plurality of profiles corresponding to a plurality of faults; and

comparing the generated component profile with the stored plurality of profiles;

wherein the determining the accuracy of the fault indication is further based on the comparison of the generated component profile with the stored plurality of profiles.

13. The method in accordance with claim 12, further comprising determining at least one potential sensor error based on the comparison of the generated component profile with the stored plurality of profiles.

14. The method in accordance with claim 11, wherein the generated component profile includes a total harmonic distortion of the signals of the one or more sensors.

15. The method in accordance with claim 11, wherein the generated component profile includes a total harmonic distortion of the signals of the one or more sensors over a period of time prior to and a period of time after the fault.

16. The method in accordance with claim 11, further comprising determining a potential cyber-attack based on the accuracy of the fault indication.

17. A computer-readable storage device having processor-executable instructions embodied thereon, for detecting false data injection attacks, wherein when executed by a fault detection computer device communicatively coupled to a memory, the processor-executable instructions cause the fault detection computer device to:

receive signals representing measurement data from the one or more sensors that monitor a component and generate signals representing the measurement data associated with the component;

receive signals from a first sensor and a second sensor of the one or more sensors, wherein the first sensor is proximate to the component and the second sensor is a distance from the first sensor;

receive a fault indication of a fault associated with the component;

generate a component profile for the component based on the measurement data;

determine a first profile based on the signals from the first sensor;

determine a second profile based on the signals from the second sensor;

compare the first profile to the second profile based on the distance between said the first sensor and said second sensor; and

determine an accuracy of the fault indication based upon the generated component profile and the comparison.

18. The computer readable storage device of claim 17, wherein the processor-executable instructions cause the fault detection computer device to:

store a plurality of profiles corresponding to a plurality of faults;

compare the generated component profile with the stored plurality of profiles; and

wherein the determination of the accuracy of the fault indication is further based on the comparison.