Distributed estimation and detection of anomalies in control systems

• US 9,961,089 B1
• Filed: 10/20/2016
• Issued: 05/01/2018
• Est. Priority Date: 10/20/2016
• Status: Active Grant

• Current Assignee: Mitsubishi Electric Research Laboratories, Inc. (Mitsubishi Electric Corporation)
• Original Assignee: Mitsubishi Electric Research Laboratories, Inc. (Mitsubishi Electric Corporation)
• Inventors: Sun, Hongbo, Minot, Ariana
• Primary Examiner(s): LEMMA, SAMSON B
• Application Number:
  US15/298,392
• Publication Number:
  US 20180115561A1
• Time in Patent Office: 558 Days
• Field of Search: 726 23
• CPC Class Codes: G05B 23/0208 characterized by the configuration of the monitoring system
• CPC Class Codes: H02J 13/00001 characterised by the display of information or by user interaction, e.g. supervisory control and data acquisition systems [SCADA] or graphical user interfaces [GUI]
• CPC Class Codes: H02J 2203/20 Simulating, e g planning, reliability check, modelling or computer assisted design [CAD]
• CPC Class Codes: H02J 3/00 Circuit arrangements for ac mains or ac distribution networks
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: Y02E 60/00 Enabling technologies; Technologies with a potential or indirect contribution to GHG emissions mitigation
• CPC Class Codes: Y04S 10/40 Display of information, e.g. of data or controls
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

Methods and Systems for detecting anomalies in a control area of a control system. Estimating for the control area, a first state from a historical state over a first time period using a model of dynamics, and defining a transition of the first state as a function of control inputs, the first state includes a generator state for each generator, the control inputs include a network state for each bus, a mechanical input to each generator or power consumptions at the buses. Updating estimated first state, by connecting measurements of rotor frequency of each generator and measurements of the network states on the buses with the generator state of each generator, to obtain a second state over a second time period later than the first time period, and detecting anomalies based on a statistic deviation of the second state from its corresponding prediction derived from the first state.

Claims

1. A method for detecting anomalies in a control area of a control system with multiple control areas, wherein the control area includes a set of generators in communication with a set of buses and some neighboring buses of neighboring controls area of the control system, comprising:

accessing a memory in communication with at least one hardware processor, wherein the memory includes stored historical states of the control area;

estimating, by the hardware processor, a first state of the control area over a first state time period from the historical states of the control area, using a model of dynamics of the control area, and defining a transition of the first state of the control area as a function of control inputs, wherein the first state of the control area includes a generator state for each generator in the control area, wherein the control inputs include one or combination of;

a network state for each bus in the control area;

a network state for some neighboring buses of neighboring controls areas;

a mechanical input to each generator in the control area;

or power consumptions at the buses in the control area;

updating, by the hardware processor, the estimated first state of the control area according to a measurement model of the control area, by;

connecting measurements of the rotor frequency of each generator;

a weighted combination of measurements of the network states on the buses in the control area and some neighboring buses of neighboring controls areas;

with the generator state of each generator in the control area, to obtain a second state of the control area over a second state time period later than the first state time period; and

detecting, by the hardware processor, the anomalies based on a statistic deviation of the second state of the control area from its corresponding prediction derived from the first state of the control area.

2. The method of claim 1, wherein the generator state includes a rotor angle and a frequency of each generator in the set of generators in the control area.

3. The method of claim 1, wherein the network state includes a voltage phase angle at each bus in the set of buses in the control area.

4. The method of claim 1, wherein the first state time period and the second state time period each cover approximately the same time interval.

5. The method of claim 1, wherein the control system is an electric power system (EPS).

6. The method of claim 1, wherein the anomalies include cyber-attacks and power consumption anomalies.

7. The method of claim 1, wherein the second state of the control area are real-time observations.

8. The method of claim 1, further comprising:

determining whether, the statistic deviation of the second state from its corresponding prediction derived from the first state of the control area is associated with a cyber attack based, at least in part, on historical cyber attack data stored in a memory in communication with the hardware processor.

9. The method of claim 1, further comprising:

determining whether the statistic deviation of the second state from its corresponding prediction derived from the first state of the control area is associated with a cyber attack based, at least in part, on historical anomalies associated with historical states of the control area indicating there is not a cyber attack.

10. The method of claim 9, further comprising:

receiving an input from a surface of a user interface in communication with the hardware processor, by a user, of the historical anomalies associated with historical states of the control area that are not indicative of a cyber attack.

11. The method of claim 1, further comprising:

determining, by the hardware processor, whether the statistic deviation of the second state from its corresponding prediction derived from the first state of the control area is associated with a cyber attack based, at least in part, on exceeding a cyber attack threshold;

providing a notification responsive to the statistic deviation of the second state from its corresponding prediction derived from the first state of the control area exceeding the cyber attack threshold.

12. The method of claim 1, wherein the model of dynamics of the control area includes using an iterative inversion solution for a covariance matrix and communications among adjacent control areas within the pre-determined neighborhood distance.

13. The method of claim 1, wherein the measurement model of the control area is based on measurements at the control area and neighboring buses of adjacent control areas within a pre-determined neighborhood distance.

14. The method of claim 1, wherein the detecting of the anomalies includes:

determining a function of a covariance matrix of the deviation of the second state from its corresponding prediction derived from the first state of the control area;

comparing the function of the covariance matrix with a threshold determined as a multiple of a variance of the function of the covariance matrix allowed by uncertainties of the model of dynamics and the model of measurements; and

detecting a cyber-attack when the function of the covariance matrix is above the threshold.

15. A system for detecting anomalies in a control area of a power system with multiple control areas, wherein the control area includes a set of generators in communication with a set of buses and some neighboring buses of neighboring controls area of the control system, comprising:

a computer readable memory to store historical states of the control area, current states of the control area, a model of dynamics of the control area and a measurement model of the control area;

a set of sensors arranged to sense measurements in the control area for the set of generators, the set of buses and to measure one or combination of rotor frequencies for each generator, voltage phase angles on the buses, a mechanical input to each generator, or power consumptions at the buses;

a hardware processor in communication with the computer readable memory configured to;

estimate a first state of the control area from a historical state of the control area over a first state time period using the stored model of dynamics of the control area, and defining a transition of the first state of the control area as a function of control inputs, wherein the first state of the control area includes a rotor angle and a rotor frequency for each generator in the control area, wherein the control inputs include one or combination of phase angles on the buses of the control area, a mechanical input to each generator in the control area, and power consumptions at the buses in the control area;

update the estimated first state of the control area according to the stored measurement model of the control area, by connecting measurements of the rotor frequency of each generator in the control area and a weighted combination of measurements of the voltage phase angles on the buses of the control area and some neighboring buses of the neighboring control areas, with the rotor angle and the rotor frequency of each generator in the control area, to obtain a second state of the control area over a second state time period later than the first state time period; and

detect the anomalies based on a statistic deviation of the second state from its corresponding prediction derived from the first state of the control area.

16. The system of claim 15, wherein the first state time period and the second state time period each cover approximately the same time interval and the second state of the control area are real-time observations.

17. The system of claim 15, wherein the detected anomalies assist in managing the management of the EPS.

18. The method of claim 15, wherein the detecting of the anomalies includes:

determining a function of a covariance matrix of the deviation of the second state from its corresponding prediction derived from the first state of the control area;

comparing the function of the covariance matrix with a threshold determined as a multiple of a variance of the function of the covariance matrix allowed by uncertainties of the model of dynamics and the model of measurements; and

detecting a cyber-attack when the function of the covariance matrix is above the threshold.

19. A detector for detecting anomalies in a control area of an electric power system (EPS) with multiple control areas, wherein the control area includes a set of generators in communication with a set of buses and some neighboring buses of neighboring controls area of the control system, comprising:

acquire a plurality of measurements from sensors configure for sensing the set of generators and the set of buses over a first state time period;

acquire a respective second plurality of measurements from sensors configure for sensing the set of generators and the set of buses over a second state time period;

at least one hardware processor having a computer readable memory configured to;

receive the plurality of measurements sensed by the sensors over the first state time period;

estimate a first state of the control area from a historical state of the control area over the first state time period using a model of dynamics of the control area, and defining a transition of the first state of the control area as a function of control inputs, wherein the first state of the control area includes a rotor angle and a rotor frequency for each generator in the control area, wherein the control inputs include one or combination of phase angles on the buses of the control area, a mechanical input to each generator in the control area, and power consumptions at the buses in the control area;

receive the plurality of measurements sensed by the sensors over the second state time period;

update the estimated first state of the control area according to a measurement model of the control area, by connecting sensed measurements of the rotor frequency of each generator in the control area and a weighted combination of sensed measurements of the phase angles on the buses of the control area and some neighboring buses of the neighboring control areas, with the rotor angle and the rotor frequency of each generator in the control area, to obtain a second state of the control area over the second state time period later than the first state time period; and

detect the anomalies based on a statistic deviation of the second state of the control area from its corresponding prediction derived from the first state of the control area.

20. The detector of claim 19, wherein the first state time period and the second state time period each cover approximately the same time interval and the second state of the control area are real-time observations.