Towards Real-Time Distinction of Power System Faults and Cyber Attacks

Research output: Chapter in Book/Conference proceedings/Edited volumeConference contributionScientificpeer-review

51 Downloads (Pure)


This paper presents a methodology to distinguish between three-phase faults and GOOSE cyber attacks, aimed at opening the circuit breakers in the power grid. We propose a scheme that utilizes Phasor Measurement Unit (PMU)-enabled monitoring of power grid states, and communication network packet logs in the substation. In this scheme, by leveraging both cyber and physical data correlations and applying a Seasonal Autoregressive Moving Average (SARMA) model, we successfully distinguish between 3-phase faults and cyber attacks. The proposed scheme is tested using the benchmark IEEE 9-bus system, and can distinguish cyber attacks from faults in less than 0.2s. This demonstrates the usefulness of the proposed scheme for power system cyber security analytics.
Original languageEnglish
Title of host publication2023 IEEE Power and Energy Society General Meeting, PESGM 2023
Place of PublicationOrlando, FL, USA
Number of pages5
ISBN (Electronic)978-1-6654-6441-3
Publication statusPublished - 2023

Publication series

NameIEEE Power and Energy Society General Meeting
ISSN (Print)1944-9925
ISSN (Electronic)1944-9933

Bibliographical note

Green Open Access added to TU Delft Institutional Repository ‘You share, we take care!’ – Taverne project
Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public.


Dive into the research topics of 'Towards Real-Time Distinction of Power System Faults and Cyber Attacks'. Together they form a unique fingerprint.

Cite this