Apparatus and method for detecting an intrusion in electric power networks

In a method for detecting an intrusion in an electric power network, status signals are measured from the electric power network. A vector (Y(t)) of the measured status signals is supplied to a filter (1), a transfer function of which filter (1) is given by N(p)*L(p) with p representing a differential operator, wherein L(p) is a polynomial matrix in the differential operator p to be applied to the status signal vector (Y(t)), and N(p) is a polynomial vector in the differential operator p and represents a solution to equation N(p)*H(p)=0 wherein H(p) is a polynomial matrix in the differential operator p to be applied to internal status signals (x(t)) and/or to a load deviation pattern (d(t)) applied to a model of the electric power network. The filter (1) supplies an intrusion detection signal (r(t)) in response to applying the received status signal vector (Y(t)) to the filter (1). In a preferred approach, the filter is designed as insensitive as possible to load deviations