This work proposes a deep graph learning framework to identify, locate, and classify power, cyber, and cyber power events at the distribution system level. The proposed algorithm jointly exploits spatial, temporal, and node-level cyber and physical data features. The developed graph neural network, together with a deep autoencoder, utilizes physical measurements from distribution level phasor measurement units and cyber data from communication network logs. The spatial structure of the synchrophasor measurements and network is incorporated through a weighted adjacency matrix. The temporal structure is incorporated by defining a spatial operation in the gated recurrent unit. This spatio-temporal learning element resides inside a power event detection, localization, and classification module that provides the degree of confidence for an event label. To accurately pinpoint the location of an event to the nearest bus equipped with a measurement unit, a combination of squared error and proximity score is utilized. Also included is a cyber event detection module that employs heteroskedasticity to analyze the significance of various cyber features during different types of attacks. Finally, a dual-bit cyber-power decision table determines the nature of the event. The proposed method is validated on two distribution systems modeled in OPAL-RT/Hypersim with limited phasor measurement units for different possible physical and cyber events. Further analyses include comparison with other state-of-the-art methods and validation in the presence of measurement noise. Our method outperforms existing approaches and achieves an average detection accuracy of 97.97%, F1-score of 96.88%, precision of 96.53%, and recall of 98.57%.

A large volume of data is typically needed to achieve an accurate solar generation prediction. However, not all types of data are consistently available. Various research efforts have addressed this challenge by developing methods that identify the most relevant features for predicting solar generation. However, the optimal features vary with different weather patterns, making it impossible to select a fixed set of optimal features for all weather patterns. This study develops a new framework to accurately predict solar irradiance using dynamically changing optimal features. The developed model first incorporates feature extraction with clustering techniques to identify representative weather data from a dataset. Next, using deep reinforcement learning (DRL), a new feature selection method is developed to yield the minimum features required to accurately forecast solar irradiance from representative data. Benefiting from the model-free nature of DRL, the developed method is adaptive to various weather conditions, and dynamically alters the selected features. Case studies using real-world data have shown that the developed model significantly reduces the volume of data required for accurate irradiance forecasting for different weather patterns.

Effective mitigation of thermal overloads is crucial in preventing power grid outages. With large-scale adoption of phasor measurement units, new and more effective mitigation opportunities have emerged. However, the possibility of false data attacks on the measured data, or the relay status information, threatens the promise of utilizing measurements for timely mitigation of thermal overloads. False data can lead to wrong estimation of the system states and the power flow model, which may eventually lead to wrong mitigations. To address these newly introduced challenges, in this article, a data-driven model-predictive control method is introduced for mitigation of the thermal overloads, which is resilient to false data injection attacks. This is achieved by constructing a data-driven power flow model from the trustworthy system measurements, which is independent from system topology and model parameters. Hence, the power flow model becomes immune to wrong system model information. To eliminate the adverse impacts of false data on the measurements, the actual system states are recovered from the historical trustworthy data if an attack is detected. Case studies demonstrate that the developed model predictive control methodology effectively identifies the optimal mitigations in a finite prediction horizon.

Today’s critical infrastructure systems are more interconnected and dependent on the electric power grid. This interdependence means that disruptions in one system can have far-reaching consequences across many others. This is particularly evident when a cyberattack in the power grid leads to widespread outages and disrupts essential societal services. To prevent such disasters, it is crucial that proactive actions are taken to secure our power grid control centers and digital substations. This is where digital twins (DTs) play an important role: By creating virtual replicas of cyberphysical assets and processes, DTs allow system operators to anticipate and address potential vulnerabilities in our cybersecurity defenses before they can be exploited. As such, a DT can be considered as a key contributor to safeguard the power system against cyberattacks. This article examines the potential future benefits of DTs in enabling a cybersecure and resilient power grid, explores multiple use cases, and proposes a path forward.

A novel online and adaptive machine-learning approach for network intrusion detection is proposed in this work with a use case of unknown attack detection in the industrial cyber-physical power grid. Existing machine-learning (ML) based-intrusion detection systems in cyber-physical power systems rely on a fixed dataset with known attack anomalies for training. These approaches can lead to poor detection accuracy as unknown cyber-attacks target the system. As a result, these ML approaches need to be re-trained from scratch. This research proposes an adaptive network intrusion detection technique that identifies anomalies in industrial cyber-power grids and is capable of detecting unknown attacks with significant accuracy. The proposed intrusion detector, a neural network with adaptive moment estimation, incorporates an adaptive incremental learning when exposed to a new vulnerability. It can be deployed at the device level in the phasor measurement network systems and evolves with the latest knowledge-base of cyber threats. The proposed approach is validated using a real cyber-physical simulation environment consisting of real-time digital simulator, multiple hardware phasor measurement units, and a network simulator under two different scenarios of unknown attacks, and extensive analysis is performed for different network architecture, training epochs, choice of loss functions, and the volume of data utilized. Results show that the incremental approach improves the accuracy of brute-force attacks to > 99.9% and penetrationtest attacks to 63.7%. Further, the applicability of our method is validated on two publicly available datasets where incremental learning improved DDoS attack detection accuracy to 97.7%, UDP attacks to 73.1%, DoS attacks to 99% and Scan attacks to 94.2%.