Real-time Protection Against Microgrid False Data Injection Attacks Using Passive Monitoring

Microgrids are continuing to play a big role in the smart grids by offering higher reliability and integration of Distributed Energy Resources (DERs). Due to their dependence on accurate and authenticated data, microgrids subjected to False Data Injection (FDI) attacks can have their ability to provide energy negatively impacted. In this paper, a real-time centralized monitoring scheme is proposed to detect and mitigate FDI attacks that falsely portray a line fault. Passive monitoring devices are deployed in multiple regions of the microgrid, and data-driven neural network techniques are used to compute the extent that line measurement inferred from incoming IEC 61850 Sampled Value (SV) frames deviate from expected operation. The deviations are reported to a central security manager, which determines whether or not an FDI attack is underway based on the amount of inconsistency in the reported deviations. The impact of FDI attacks that present the microgrid as being under fault is demonstrated on a microgrid co-simulation testbed. The proposed centralized detection approach is found to be effective at identifying fault FDI attacks in cases where a minority subset of sensors is targeted.