Detection of Hidden Transformer Tap Change Command Attacks in Transmission Networks

Abstract

Transformer taps are used extensively to regulate bus voltages in transmission networks. Tap change commands relayed through the SCADA network are attractive targets for falsification by attackers in order to adversely affect the operation of the system. Such attacks can be hidden by selective measurement manipulations. In this paper, an algorithm is developed that detects the presence of a stealthy false tap change command. The development of the algorithm is based on the intuition that any attack involving injection of false data or commands can only influence the measurement and estimation of certain selected variables, not all of them. The algorithm is based on the ratios of injection or branch currents to the voltages of the terminal nodes of the tap changing transformers. This principle is proven analytically and validated using simulations, leading to the establishment of an index which distinguishes stealthy attacks from normal operation scenarios. This lead to the development of an algorithm which is simple to implement, computationally light and shown to be extremely reliable when tested across various cases on the IEEE 118-bus and 2383-bus Polish systems.