Professional Documents
Culture Documents
I. INTRODUCTION
611
645
684
652
632
671
633
692
634
675
680
}
Fig. 5: Data flow diagram
B. The Reasoner
Unlike traditional approaches that rely exclusively on
pattern recognition and anomaly detection, the reasoner [13]
[15] uses a hybrid pattern recognition approach that assesses
not only deviations from norms but also conformance with
prototypical exploits and behaviors that have been identified.
It is characterized by a two-step process.
1) Detector
First, the reasoner uses multiple detectors to examine the
data sources, and each detector processes data independently.
In this paper, the data sources examined are energy, power
voltage,
current,
communication
status,
weather,
neighborhood energy usages, and customer delinquency
information. For each detector, the measurement data are
compared to the information passed from the predictive model
for abnormality. The information from the predictive model is
a threshold with various forms. The thresholds can be datadriven or specified; a threshold can be a value or a fuzzy set.
In addition, some thresholds are values accumulated over
time, for example, the attack attempts and the customer
delinquency record.
In some cases, the threshold is a scalar value. For example,
the tripping of a circuit breaker either occurs or does not. For
some measurements, however, the threshold may have two or
more values. For example, voltages below 95% or higher than
105% per unit (p.u.) value are considered under-voltage or
over-voltage, respectively. In addition, there is a duration
requirement. Only when the system voltage is higher or lower
than the per unit value that exceeds a duration of t is it
considered an over- or under-voltage event. Therefore, these
450
400
400
350
350
450
300
250
200
150
100
300
250
200
150
100
50
500
above High limit
50
10
20
30
Household ID
40
50
0
0
0.2
0.4
0.6
0.8
Value of the fuzzy membership function
Technical
Voltage
Energy
Equipment
Failure
Feeder outage
Meter outage
Com outage
Cyber Attacks
Billing
Payment History
Neighborhood Background his
Energy
Theft
Cyber
Attack History
Equipment Attack Possibility
Environment
Lighting/Wind/T(quakes/etc)
Tree/Snake/Squirrel
e
jac
Ad
as
a re
nt
Time
Space
1.0
Bad Weather
REFERENCES
[1] Litos Strategic Communication, The Smart Grid: an Introduction,
http://www.oe.energy.gov/1165.htm.
[2] J. Meserve, Smart Grid may be vulnerable to hackers,
http://www.cnn.com/2009/TECH/03/20/smartgrid.vulnerability/index.html.
[3] J. Osborne, Electrical Smart Grid Not Yet Smart Enough to Block
Hackers, http://www.foxnews.com/story/0,2933,511648,00.html.
[4] PMU guidance: http://www.naspi.org/pmu.stm.
[5] C. McKenna, Smart Grid
http://www.govtech.com/gt/626637.
Security
Requirements
Released,
Outage
Cyber Attack
Meter Outage
Energy theft
Comm Errors
Norm Outage
Lack of Data
VIII. CONCLUSIONS
The benefit of an investment in smart grid infrastructure is
the availability of high resolution data collected from more
measurement points. To monetize the benefit, information that
can facilitate the grid operation, maintenance, and planning
needs to be extracted from these data sets and made available
to grid operators in an actionable manner. Therefore, in a
smart grid infrastructure, there is a critical need to analyze the
data collected by multiple control and communication
networks 1) to characterize the states of the smart grid and 2)
to improve data integrity by detecting corrupted or erroneous
measurement data. To this end, we developed a multi-layer,
hierarchical information management system. In this paper,
we presented design considerations, physical and information
network configurations, data flow generations, detector
design, and testing results of the PDM.
The contributions of this paper are summarized as follows:
1) This paper demonstrates the design of the IMS, which
is a comprehensive modeling platform to integrate
different aspects of smart grid operations such as
wholesale market, power grid models, communication and
control network, and custom behavior and environmental
factors.
2) A reasoner is developed for predicting and identifying
an abnormal system behavior. A reasoner automatically
identifies the correlation and interdependence of data
streams to detect the abnormal situation and improve the
data integrity.