Methods of anomaly state detection for power systems based on bilateral cyber‐physical information

Abstract

Cyberattacks have emerged as novel threats to modern power systems. By exploiting the vulnerabilities of insecure devices, an attacker can inject viruses to lurk and collect system conditions through sniffing and then launch well-designed attacks. Collaboratively applying bilateral cyber-physical information can help to detect anomalous system states caused by sniffing, which can isolate virus impacts on the cyber side and ensure the stable operation of power systems. Here, a dynamic weight ensemble isolation forest algorithm is proposed to mine anomaly system states utilizing bilateral information based on the hypothesis that the fused cyber-physical system state under assault has the shortest average path length in a constructed random forest. In addition, the proposed algorithm is able to realize improved performance in power system anomaly status mining and adapt to constantly changing power systems. The method is verified by simulations on a co-simulation platform. The results show that the method outperforms other anomaly detection methods.