A cyber-resilient mechanism for detection, classification and mitigation of intrusion on synchrophasor data in power networks

Soma Bhattacharya, Brundavanam Seshasai, Ebha Koley and Subhojit Ghosh

International Journal of Critical Infrastructure Protection, 2025, vol. 50, issue C

Abstract: In recent times, owing to their ability in providing accurate synchronized phasor information with global positioning system (GPS) based common time reference, phasor measurement units (PMUs) have emerged as one of the most significant components of the wide-area monitoring system of modern power networks. However, the use of public GPS signal and increased dependence on the communication infrastructure for transmitting phasor information have made the PMU (also referred to as synchrophasor) dependent operations highly vulnerable to the cyber intrusions. Intrusions on synchrophasor data is generally executed by either manipulating the common time reference (referred to as time synchronization attack (TSA)) or by injecting a falsified data into the actual PMU acquired signal to recreate a non-existing scenario (referred to as replay attack (RA)). For both the attacks, the acquisition of manipulated data at the control centre negatively disturbs the wide-area monitoring and control operations, which might even lead the network to blackout. Motivated by the requirement of increasing the resiliency of power networks against TSA and RA, the development of an accurate, reliable and comprehensive scheme for detecting, classifying and mitigating the impact of phasor intrusions has been sought in the present work. The three-stage mechanism involves processing of the phasor data acquired from multiple PMUs using bi-directional gated recurrent unit (Bi-GRU) based classifiers to detect intrusion (first stage) and further classify the type of intrusion as TSA or RA (second stage). Post-intrusion classification, in the final stage, Bessel interpolation is applied to filter out the spoofed data and further replace it with intrusion-free (pre-attack) data. The proposed scheme has been extensively validated for practical settings in real-time testbed with regards to detecting intrusions, distinguishing intrusions from contingencies, classifying intrusion and estimating the state variables closer to the pre-attack levels.

Keywords: Time synchronization attack; Replay attack; Phasor measurement unit; GPS spoofing; Bessel interpolation (search for similar items in EconPapers)
Date: 2025
References: Add references at CitEc
Citations:

Downloads: (external link)
http://www.sciencedirect.com/science/article/pii/S1874548225000460
Full text for ScienceDirect subscribers only

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:eee:ijocip:v:50:y:2025:i:c:s1874548225000460

DOI: 10.1016/j.ijcip.2025.100785

Access Statistics for this article

International Journal of Critical Infrastructure Protection is currently edited by Leon Strous

More articles in International Journal of Critical Infrastructure Protection from Elsevier
Bibliographic data for series maintained by Catherine Liu ().