Smart PV Inverter Cyberattack Detection using Hardware-in-the-Loop Test Facility
This paper evaluates residential smart photovoltaic (PV) inverters' responses to cyberattacks and assesses the performance of an intrusion detection strategy for smart grid devices by comparing time-series power flow results from a simulation application called Faster Than Real-Time (FTRT) Simu...
Gespeichert in:
Veröffentlicht in: | IEEE access 2023-01, Vol.11, p.1-1 |
---|---|
Hauptverfasser: | , , , , , |
Format: | Artikel |
Sprache: | eng |
Schlagworte: | |
Online-Zugang: | Volltext |
Tags: |
Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
|
container_end_page | 1 |
---|---|
container_issue | |
container_start_page | 1 |
container_title | IEEE access |
container_volume | 11 |
creator | Kaewnukultorn, Thunchanok Sepulveda-Mora, Sergio B. Broadwater, Robert Zhu, Dan Tsoutsos, Nektarios G. Hegedus, Steven |
description | This paper evaluates residential smart photovoltaic (PV) inverters' responses to cyberattacks and assesses the performance of an intrusion detection strategy for smart grid devices by comparing time-series power flow results from a simulation application called Faster Than Real-Time (FTRT) Simulator to measurements from a Power Hardware-in-the-Loop (P-HIL) laboratory as a testbed. Twenty different cyberattacks from three classes - Denial of Service (DoS), Intermittent attack, and Modification - were designed and tested with grid-tied smart inverters in order to study the inverters' responses to malicious activities. The intrusion detection strategy was developed using a comparison between the predicted PV power output from FTRT and the power flows measured from P-HIL laboratory through the API interface. Real and reactive power thresholds were assigned based on a number of repeated experiments to ensure the applicability of the thresholds. The results showed that inverters from different manufacturers have their own unique responses which could be detected by the power flow measurements. Our detection method could identify over 94% of actual malicious actions and 7.4% of no-attack hours are detected as false positives. Out of 38 under-attack hours, 2 undetected hours are due to the intermittent attacks. Different attacks can be detected based on the targeted components of the complex power that attackers are aiming to cause disturbances. Our findings additionally show that DoS can be noticed immediately after the devices have been sabotaged, and they can be detected from the active power analysis. However, modification attack detection will depend more on the reactive power measurements, while intermittent attacks remain the most challenging for the proposed detection method since the objective of intermittent attacks is to create an oscillation of the complex power components which need a relatively high time resolution for the measurement. |
doi_str_mv | 10.1109/ACCESS.2023.3308052 |
format | Article |
fullrecord | <record><control><sourceid>proquest_osti_</sourceid><recordid>TN_cdi_osti_scitechconnect_1996426</recordid><sourceformat>XML</sourceformat><sourcesystem>PC</sourcesystem><ieee_id>10227258</ieee_id><doaj_id>oai_doaj_org_article_e5881f0884344b7abeb0bdd10979ec18</doaj_id><sourcerecordid>2859716019</sourcerecordid><originalsourceid>FETCH-LOGICAL-c436t-b89a9777df4ece45c506ea32a00472f7bc1b5ac9ac257b322b2e41cad30ff3803</originalsourceid><addsrcrecordid>eNpNkc1qGzEUhYfQQkKaJ0gWQ7seV78jaRmmSWwwNOA0WyFp7thy3JEryQl--yodU6KNxOWcw_10quoaoxnGSH2_7bq71WpGEKEzSpFEnJxVFwS3qqGctp8-vM-rq5S2qBxZRlxcVI-r3ybm-vG5XoyvEDPEujtaiCZn417qH5DBZR_G-pD8uK7nJvZvJkLjxyZvoFmGsK-fIOX63ji_8_n4pfo8mF2Cq9N9Wf26v3vq5s3y58Oiu102jtE2N1Yqo4QQ_cDAAeOOoxYMJQYhJsggrMOWG6eMI1xYSoglwLAzPUXDQCWil9Viyu2D2ep99IXjqIPx-t8gxLUuYN7tQAOXEg9ISkYZs8JYsMj2ffk7ocBhWbK-TlkhZa-T8wV648I4FnaNlWoZaYvo2yTax_DnUJD1NhziWBg1kVwJ3CKsiopOKhdDShGG_6thpN_r0lNd-r0ufaqruG4mlweADw5CBOGS_gX9Lo-9</addsrcrecordid><sourcetype>Open Website</sourcetype><iscdi>true</iscdi><recordtype>article</recordtype><pqid>2859716019</pqid></control><display><type>article</type><title>Smart PV Inverter Cyberattack Detection using Hardware-in-the-Loop Test Facility</title><source>IEEE Open Access Journals</source><source>DOAJ Directory of Open Access Journals</source><source>Elektronische Zeitschriftenbibliothek - Frei zugängliche E-Journals</source><creator>Kaewnukultorn, Thunchanok ; Sepulveda-Mora, Sergio B. ; Broadwater, Robert ; Zhu, Dan ; Tsoutsos, Nektarios G. ; Hegedus, Steven</creator><creatorcontrib>Kaewnukultorn, Thunchanok ; Sepulveda-Mora, Sergio B. ; Broadwater, Robert ; Zhu, Dan ; Tsoutsos, Nektarios G. ; Hegedus, Steven ; Electrical Distribution Design, Inc., Blacksburg, VA (United States)</creatorcontrib><description>This paper evaluates residential smart photovoltaic (PV) inverters' responses to cyberattacks and assesses the performance of an intrusion detection strategy for smart grid devices by comparing time-series power flow results from a simulation application called Faster Than Real-Time (FTRT) Simulator to measurements from a Power Hardware-in-the-Loop (P-HIL) laboratory as a testbed. Twenty different cyberattacks from three classes - Denial of Service (DoS), Intermittent attack, and Modification - were designed and tested with grid-tied smart inverters in order to study the inverters' responses to malicious activities. The intrusion detection strategy was developed using a comparison between the predicted PV power output from FTRT and the power flows measured from P-HIL laboratory through the API interface. Real and reactive power thresholds were assigned based on a number of repeated experiments to ensure the applicability of the thresholds. The results showed that inverters from different manufacturers have their own unique responses which could be detected by the power flow measurements. Our detection method could identify over 94% of actual malicious actions and 7.4% of no-attack hours are detected as false positives. Out of 38 under-attack hours, 2 undetected hours are due to the intermittent attacks. Different attacks can be detected based on the targeted components of the complex power that attackers are aiming to cause disturbances. Our findings additionally show that DoS can be noticed immediately after the devices have been sabotaged, and they can be detected from the active power analysis. However, modification attack detection will depend more on the reactive power measurements, while intermittent attacks remain the most challenging for the proposed detection method since the objective of intermittent attacks is to create an oscillation of the complex power components which need a relatively high time resolution for the measurement.</description><identifier>ISSN: 2169-3536</identifier><identifier>EISSN: 2169-3536</identifier><identifier>DOI: 10.1109/ACCESS.2023.3308052</identifier><identifier>CODEN: IAECCG</identifier><language>eng</language><publisher>Piscataway: IEEE</publisher><subject>Computer Science ; Cyberattack ; cyberattack detection ; cyberattacks ; Cybersecurity ; Denial of service attacks ; Engineering ; grid supporting function ; Hardware-in-the-Loop laboratory ; Hardware-in-the-loop simulation ; Intrusion detection ; Inverters ; Load flow ; MATHEMATICS AND COMPUTING ; Photovoltaic cells ; Power flow ; Power measurement ; Reactive power ; Smart grid ; Smart grids ; Smart inverters ; Telecommunications ; Test facilities ; Thresholds</subject><ispartof>IEEE access, 2023-01, Vol.11, p.1-1</ispartof><rights>Copyright The Institute of Electrical and Electronics Engineers, Inc. (IEEE) 2023</rights><lds50>peer_reviewed</lds50><oa>free_for_read</oa><woscitedreferencessubscribed>false</woscitedreferencessubscribed><citedby>FETCH-LOGICAL-c436t-b89a9777df4ece45c506ea32a00472f7bc1b5ac9ac257b322b2e41cad30ff3803</citedby><cites>FETCH-LOGICAL-c436t-b89a9777df4ece45c506ea32a00472f7bc1b5ac9ac257b322b2e41cad30ff3803</cites><orcidid>0000-0002-1248-7616 ; 0000-0001-7862-6423 ; 0000-0002-5769-0124 ; 0000-0002-0429-6764 ; 0000-0002-9847-5463 ; 0000000257690124 ; 0000000298475463 ; 0000000204296764 ; 0000000178626423 ; 0000000212487616</orcidid></display><links><openurl>$$Topenurl_article</openurl><openurlfulltext>$$Topenurlfull_article</openurlfulltext><thumbnail>$$Tsyndetics_thumb_exl</thumbnail><linktohtml>$$Uhttps://ieeexplore.ieee.org/document/10227258$$EHTML$$P50$$Gieee$$Hfree_for_read</linktohtml><link.rule.ids>230,315,782,786,866,887,2106,27642,27933,27934,54942</link.rule.ids><backlink>$$Uhttps://www.osti.gov/biblio/1996426$$D View this record in Osti.gov$$Hfree_for_read</backlink></links><search><creatorcontrib>Kaewnukultorn, Thunchanok</creatorcontrib><creatorcontrib>Sepulveda-Mora, Sergio B.</creatorcontrib><creatorcontrib>Broadwater, Robert</creatorcontrib><creatorcontrib>Zhu, Dan</creatorcontrib><creatorcontrib>Tsoutsos, Nektarios G.</creatorcontrib><creatorcontrib>Hegedus, Steven</creatorcontrib><creatorcontrib>Electrical Distribution Design, Inc., Blacksburg, VA (United States)</creatorcontrib><title>Smart PV Inverter Cyberattack Detection using Hardware-in-the-Loop Test Facility</title><title>IEEE access</title><addtitle>Access</addtitle><description>This paper evaluates residential smart photovoltaic (PV) inverters' responses to cyberattacks and assesses the performance of an intrusion detection strategy for smart grid devices by comparing time-series power flow results from a simulation application called Faster Than Real-Time (FTRT) Simulator to measurements from a Power Hardware-in-the-Loop (P-HIL) laboratory as a testbed. Twenty different cyberattacks from three classes - Denial of Service (DoS), Intermittent attack, and Modification - were designed and tested with grid-tied smart inverters in order to study the inverters' responses to malicious activities. The intrusion detection strategy was developed using a comparison between the predicted PV power output from FTRT and the power flows measured from P-HIL laboratory through the API interface. Real and reactive power thresholds were assigned based on a number of repeated experiments to ensure the applicability of the thresholds. The results showed that inverters from different manufacturers have their own unique responses which could be detected by the power flow measurements. Our detection method could identify over 94% of actual malicious actions and 7.4% of no-attack hours are detected as false positives. Out of 38 under-attack hours, 2 undetected hours are due to the intermittent attacks. Different attacks can be detected based on the targeted components of the complex power that attackers are aiming to cause disturbances. Our findings additionally show that DoS can be noticed immediately after the devices have been sabotaged, and they can be detected from the active power analysis. However, modification attack detection will depend more on the reactive power measurements, while intermittent attacks remain the most challenging for the proposed detection method since the objective of intermittent attacks is to create an oscillation of the complex power components which need a relatively high time resolution for the measurement.</description><subject>Computer Science</subject><subject>Cyberattack</subject><subject>cyberattack detection</subject><subject>cyberattacks</subject><subject>Cybersecurity</subject><subject>Denial of service attacks</subject><subject>Engineering</subject><subject>grid supporting function</subject><subject>Hardware-in-the-Loop laboratory</subject><subject>Hardware-in-the-loop simulation</subject><subject>Intrusion detection</subject><subject>Inverters</subject><subject>Load flow</subject><subject>MATHEMATICS AND COMPUTING</subject><subject>Photovoltaic cells</subject><subject>Power flow</subject><subject>Power measurement</subject><subject>Reactive power</subject><subject>Smart grid</subject><subject>Smart grids</subject><subject>Smart inverters</subject><subject>Telecommunications</subject><subject>Test facilities</subject><subject>Thresholds</subject><issn>2169-3536</issn><issn>2169-3536</issn><fulltext>true</fulltext><rsrctype>article</rsrctype><creationdate>2023</creationdate><recordtype>article</recordtype><sourceid>ESBDL</sourceid><sourceid>RIE</sourceid><sourceid>DOA</sourceid><recordid>eNpNkc1qGzEUhYfQQkKaJ0gWQ7seV78jaRmmSWwwNOA0WyFp7thy3JEryQl--yodU6KNxOWcw_10quoaoxnGSH2_7bq71WpGEKEzSpFEnJxVFwS3qqGctp8-vM-rq5S2qBxZRlxcVI-r3ybm-vG5XoyvEDPEujtaiCZn417qH5DBZR_G-pD8uK7nJvZvJkLjxyZvoFmGsK-fIOX63ji_8_n4pfo8mF2Cq9N9Wf26v3vq5s3y58Oiu102jtE2N1Yqo4QQ_cDAAeOOoxYMJQYhJsggrMOWG6eMI1xYSoglwLAzPUXDQCWil9Viyu2D2ep99IXjqIPx-t8gxLUuYN7tQAOXEg9ISkYZs8JYsMj2ffk7ocBhWbK-TlkhZa-T8wV648I4FnaNlWoZaYvo2yTax_DnUJD1NhziWBg1kVwJ3CKsiopOKhdDShGG_6thpN_r0lNd-r0ufaqruG4mlweADw5CBOGS_gX9Lo-9</recordid><startdate>20230101</startdate><enddate>20230101</enddate><creator>Kaewnukultorn, Thunchanok</creator><creator>Sepulveda-Mora, Sergio B.</creator><creator>Broadwater, Robert</creator><creator>Zhu, Dan</creator><creator>Tsoutsos, Nektarios G.</creator><creator>Hegedus, Steven</creator><general>IEEE</general><general>The Institute of Electrical and Electronics Engineers, Inc. (IEEE)</general><scope>97E</scope><scope>ESBDL</scope><scope>RIA</scope><scope>RIE</scope><scope>AAYXX</scope><scope>CITATION</scope><scope>7SC</scope><scope>7SP</scope><scope>7SR</scope><scope>8BQ</scope><scope>8FD</scope><scope>JG9</scope><scope>JQ2</scope><scope>L7M</scope><scope>L~C</scope><scope>L~D</scope><scope>OTOTI</scope><scope>DOA</scope><orcidid>https://orcid.org/0000-0002-1248-7616</orcidid><orcidid>https://orcid.org/0000-0001-7862-6423</orcidid><orcidid>https://orcid.org/0000-0002-5769-0124</orcidid><orcidid>https://orcid.org/0000-0002-0429-6764</orcidid><orcidid>https://orcid.org/0000-0002-9847-5463</orcidid><orcidid>https://orcid.org/0000000257690124</orcidid><orcidid>https://orcid.org/0000000298475463</orcidid><orcidid>https://orcid.org/0000000204296764</orcidid><orcidid>https://orcid.org/0000000178626423</orcidid><orcidid>https://orcid.org/0000000212487616</orcidid></search><sort><creationdate>20230101</creationdate><title>Smart PV Inverter Cyberattack Detection using Hardware-in-the-Loop Test Facility</title><author>Kaewnukultorn, Thunchanok ; Sepulveda-Mora, Sergio B. ; Broadwater, Robert ; Zhu, Dan ; Tsoutsos, Nektarios G. ; Hegedus, Steven</author></sort><facets><frbrtype>5</frbrtype><frbrgroupid>cdi_FETCH-LOGICAL-c436t-b89a9777df4ece45c506ea32a00472f7bc1b5ac9ac257b322b2e41cad30ff3803</frbrgroupid><rsrctype>articles</rsrctype><prefilter>articles</prefilter><language>eng</language><creationdate>2023</creationdate><topic>Computer Science</topic><topic>Cyberattack</topic><topic>cyberattack detection</topic><topic>cyberattacks</topic><topic>Cybersecurity</topic><topic>Denial of service attacks</topic><topic>Engineering</topic><topic>grid supporting function</topic><topic>Hardware-in-the-Loop laboratory</topic><topic>Hardware-in-the-loop simulation</topic><topic>Intrusion detection</topic><topic>Inverters</topic><topic>Load flow</topic><topic>MATHEMATICS AND COMPUTING</topic><topic>Photovoltaic cells</topic><topic>Power flow</topic><topic>Power measurement</topic><topic>Reactive power</topic><topic>Smart grid</topic><topic>Smart grids</topic><topic>Smart inverters</topic><topic>Telecommunications</topic><topic>Test facilities</topic><topic>Thresholds</topic><toplevel>peer_reviewed</toplevel><toplevel>online_resources</toplevel><creatorcontrib>Kaewnukultorn, Thunchanok</creatorcontrib><creatorcontrib>Sepulveda-Mora, Sergio B.</creatorcontrib><creatorcontrib>Broadwater, Robert</creatorcontrib><creatorcontrib>Zhu, Dan</creatorcontrib><creatorcontrib>Tsoutsos, Nektarios G.</creatorcontrib><creatorcontrib>Hegedus, Steven</creatorcontrib><creatorcontrib>Electrical Distribution Design, Inc., Blacksburg, VA (United States)</creatorcontrib><collection>IEEE All-Society Periodicals Package (ASPP) 2005-present</collection><collection>IEEE Open Access Journals</collection><collection>IEEE All-Society Periodicals Package (ASPP) 1998-Present</collection><collection>IEEE Electronic Library (IEL)</collection><collection>CrossRef</collection><collection>Computer and Information Systems Abstracts</collection><collection>Electronics & Communications Abstracts</collection><collection>Engineered Materials Abstracts</collection><collection>METADEX</collection><collection>Technology Research Database</collection><collection>Materials Research Database</collection><collection>ProQuest Computer Science Collection</collection><collection>Advanced Technologies Database with Aerospace</collection><collection>Computer and Information Systems Abstracts Academic</collection><collection>Computer and Information Systems Abstracts Professional</collection><collection>OSTI.GOV</collection><collection>DOAJ Directory of Open Access Journals</collection><jtitle>IEEE access</jtitle></facets><delivery><delcategory>Remote Search Resource</delcategory><fulltext>fulltext</fulltext></delivery><addata><au>Kaewnukultorn, Thunchanok</au><au>Sepulveda-Mora, Sergio B.</au><au>Broadwater, Robert</au><au>Zhu, Dan</au><au>Tsoutsos, Nektarios G.</au><au>Hegedus, Steven</au><aucorp>Electrical Distribution Design, Inc., Blacksburg, VA (United States)</aucorp><format>journal</format><genre>article</genre><ristype>JOUR</ristype><atitle>Smart PV Inverter Cyberattack Detection using Hardware-in-the-Loop Test Facility</atitle><jtitle>IEEE access</jtitle><stitle>Access</stitle><date>2023-01-01</date><risdate>2023</risdate><volume>11</volume><spage>1</spage><epage>1</epage><pages>1-1</pages><issn>2169-3536</issn><eissn>2169-3536</eissn><coden>IAECCG</coden><abstract>This paper evaluates residential smart photovoltaic (PV) inverters' responses to cyberattacks and assesses the performance of an intrusion detection strategy for smart grid devices by comparing time-series power flow results from a simulation application called Faster Than Real-Time (FTRT) Simulator to measurements from a Power Hardware-in-the-Loop (P-HIL) laboratory as a testbed. Twenty different cyberattacks from three classes - Denial of Service (DoS), Intermittent attack, and Modification - were designed and tested with grid-tied smart inverters in order to study the inverters' responses to malicious activities. The intrusion detection strategy was developed using a comparison between the predicted PV power output from FTRT and the power flows measured from P-HIL laboratory through the API interface. Real and reactive power thresholds were assigned based on a number of repeated experiments to ensure the applicability of the thresholds. The results showed that inverters from different manufacturers have their own unique responses which could be detected by the power flow measurements. Our detection method could identify over 94% of actual malicious actions and 7.4% of no-attack hours are detected as false positives. Out of 38 under-attack hours, 2 undetected hours are due to the intermittent attacks. Different attacks can be detected based on the targeted components of the complex power that attackers are aiming to cause disturbances. Our findings additionally show that DoS can be noticed immediately after the devices have been sabotaged, and they can be detected from the active power analysis. However, modification attack detection will depend more on the reactive power measurements, while intermittent attacks remain the most challenging for the proposed detection method since the objective of intermittent attacks is to create an oscillation of the complex power components which need a relatively high time resolution for the measurement.</abstract><cop>Piscataway</cop><pub>IEEE</pub><doi>10.1109/ACCESS.2023.3308052</doi><tpages>1</tpages><orcidid>https://orcid.org/0000-0002-1248-7616</orcidid><orcidid>https://orcid.org/0000-0001-7862-6423</orcidid><orcidid>https://orcid.org/0000-0002-5769-0124</orcidid><orcidid>https://orcid.org/0000-0002-0429-6764</orcidid><orcidid>https://orcid.org/0000-0002-9847-5463</orcidid><orcidid>https://orcid.org/0000000257690124</orcidid><orcidid>https://orcid.org/0000000298475463</orcidid><orcidid>https://orcid.org/0000000204296764</orcidid><orcidid>https://orcid.org/0000000178626423</orcidid><orcidid>https://orcid.org/0000000212487616</orcidid><oa>free_for_read</oa></addata></record> |
fulltext | fulltext |
identifier | ISSN: 2169-3536 |
ispartof | IEEE access, 2023-01, Vol.11, p.1-1 |
issn | 2169-3536 2169-3536 |
language | eng |
recordid | cdi_osti_scitechconnect_1996426 |
source | IEEE Open Access Journals; DOAJ Directory of Open Access Journals; Elektronische Zeitschriftenbibliothek - Frei zugängliche E-Journals |
subjects | Computer Science Cyberattack cyberattack detection cyberattacks Cybersecurity Denial of service attacks Engineering grid supporting function Hardware-in-the-Loop laboratory Hardware-in-the-loop simulation Intrusion detection Inverters Load flow MATHEMATICS AND COMPUTING Photovoltaic cells Power flow Power measurement Reactive power Smart grid Smart grids Smart inverters Telecommunications Test facilities Thresholds |
title | Smart PV Inverter Cyberattack Detection using Hardware-in-the-Loop Test Facility |
url | https://sfx.bib-bvb.de/sfx_tum?ctx_ver=Z39.88-2004&ctx_enc=info:ofi/enc:UTF-8&ctx_tim=2024-12-02T13%3A02%3A29IST&url_ver=Z39.88-2004&url_ctx_fmt=infofi/fmt:kev:mtx:ctx&rfr_id=info:sid/primo.exlibrisgroup.com:primo3-Article-proquest_osti_&rft_val_fmt=info:ofi/fmt:kev:mtx:journal&rft.genre=article&rft.atitle=Smart%20PV%20Inverter%20Cyberattack%20Detection%20using%20Hardware-in-the-Loop%20Test%20Facility&rft.jtitle=IEEE%20access&rft.au=Kaewnukultorn,%20Thunchanok&rft.aucorp=Electrical%20Distribution%20Design,%20Inc.,%20Blacksburg,%20VA%20(United%20States)&rft.date=2023-01-01&rft.volume=11&rft.spage=1&rft.epage=1&rft.pages=1-1&rft.issn=2169-3536&rft.eissn=2169-3536&rft.coden=IAECCG&rft_id=info:doi/10.1109/ACCESS.2023.3308052&rft_dat=%3Cproquest_osti_%3E2859716019%3C/proquest_osti_%3E%3Curl%3E%3C/url%3E&disable_directlink=true&sfx.directlink=off&sfx.report_link=0&rft_id=info:oai/&rft_pqid=2859716019&rft_id=info:pmid/&rft_ieee_id=10227258&rft_doaj_id=oai_doaj_org_article_e5881f0884344b7abeb0bdd10979ec18&rfr_iscdi=true |