Phasor measurement unit (PMU) data manipulation attacks (PDMAs) may blind the control centers to the real-time operating conditions of power systems. Detecting these attacks accurately is essential to ensure the normal operation of power system monitoring and control. Using long-term accumulated historical PMU measurements to train a machine learning model to detect PDMAs has shown promising results. In this paper, deepautoencoder-based anomaly measurers are deployed throughout the power system to build a distributed PDMA detection framework. The architecture of a deep autoencoder and its training process are introduced. How to convert the historical PMU measurements into data samples for learning is also elaborated upon. Once trained, an anomaly measurer can assess the PDMA existence possibility of the new PMU measurements. By integrating the results of different anomaly measurers, the proposed distributed PDMA detection framework can detect PDMAs in the whole power system. The effectiveness and detection performance of the framework are discussed through experiments.

Intelligent electronic devices (IEDs) are deployed in power systems to facilitate advanced automation for controlling critical equipment. Once an IED is compromised, attackers can seize the control of the physical entities in substations. They may interrupt the normal functioning of switch devices, sabotage primary equipment and manipulate measurements to impact the stability of power supply. If multiple correlative attacks are launched simultaneously, attackers may even cause cascading failures, whose consequences are often catastrophic. In this paper, a systematic review of cyber-attacks related to IEDs and their countermeasures is provided. By retrieving relevant research, the information including potential threat vectors, attack types, and defense countermeasures are analyzed. The primary purpose of this paper is to remind the researchers and engineers of up-to-date attacks and to inspire studies on countermeasures to protect IEDs and ensure power system cybersecurity.

Substation One-Line Diagrams (SOLDs) are widely used in power systems to schematically represent electrical devices and their connection relationships. They are typically saved as raster images that cannot be directly parsed, making them difficult to query, manage, and reuse. When modeling power systems, users often have to manually draw SOLDs from scratch, which is time-consuming and prone to errors. To facilitate automated SOLD digitization, this article proposes an intelligent computer vision framework with three modules for recognizing electrical elements, labels, and topology from SOLD images. The electrical element recognition module uses a You Only Look Once (YOLO) model to detect and classify electrical device icons. The label recognition module combines a Character Region Awareness For Text detection (CRAFT) model and a Convolutional Recurrent Neural Network (CRNN) to locate and identify text labels. The topology recognition module relies on the line segment detection algorithm, the Moore-neighborhood tracking algorithm, and the Douglas-Peucker algorithm to analyze connections of electrical elements. Several enhancement strategies are also proposed to improve the performance of these universal computer vision techniques on SOLD digitization. Experiments show that the proposed framework can convert SOLD images into parseable digital files with desirable accuracy. Finally, the proposed SOLD digitization framework is integrated into a power system software to demonstrate its potential application.

Power system cyber-physical uncertainties, including measurement ambiguities stemming from cyber attacks and data losses, along with system uncertainties introduced by massive renewables and complex dynamics, reduce the likelihood of enhancing the quality of measurements. Fortunately, denoising diffusion models exhibit powerful learning and generation abilities for the complex underlying physics of the real world. To this end, this paper proposes an improved detection and imputation based two-stage denoising diffusion model (TSDM) to identify and reconstruct the measurements with various cyber-physical uncertainties. The first stage of the model comprises a classifier-guided conditional anomaly detection component, while the second stage involves diffusion-based measurement imputation component. Moreover, the proposed TSDM adopts optimal variance to accelerate the diffusion generation process with subsequence sampling. Extensive numerical case studies demonstrate that the proposed TSDM can accurately recover power system measurements despite renewables-induced strong randomness and highly nonlinear dynamics. Additionally, the proposed TSDM has stronger robustness compared to existing reconstruction networks and exhibits lower computational complexity than general denoising diffusion models.

As a cyber-physical attack targeting power systems, False Data Injection Attack (FDIA) has raised widespread concern in recent years. Many FDIA detection approaches in the literature train learning models using historical data to distinguish attacked measurements from normal ones. These approaches typically suffer from severe generalization problems. Although they can achieve good detection performance when the data has a similar distribution in the offline training and online application phases, they often perform poorly when an online operating condition is unforeseen during offline training. To address this problem, this paper proposes a two-layer Dynamic Neural Network (DyNN) framework for FDIA detection. The lower layer is like a traditional FDIA detection model, which uses a Convolutional Long Short-Term Memory (ConvLSTM) network to extract latent features, and employs a Multi-Layer Perceptron (MLP) to make detection decisions based on the extracted features. However, unlike traditional approaches where the internal parameters of the learning model are fixed after training, the internal parameters of the MLP are dynamically generated according to the online data by an upper-layer DyNN adapter. An interactive co-training mechanism is also proposed to coordinate both layers and ensure that the dynamically generated MLP parameters are best suited for FDIA detection in the current operating condition. Extensive experiments demonstrate that the two-layer DyNN framework can achieve satisfactory FDIA detection performance even though the training and test data are collected under completely different operating conditions. In the most extreme cases, the average accuracy and F1 score of the proposed DyNN-based FDIA detection framework are 4.91% and 4.24% higher than that without DyNN, respectively.