Integrated Cyber and Physical Anomaly Location and Classification in Power Distribution Systems

Identifying the anomaly location and type (fault or attack) is of paramount importance for enhancing cyber-physical situational awareness, and taking informed and effective mitigation actions in power distribution systems with an increasing number of attack points in distributed and renewable energy sources. This article proposes the fault and attack location and classification (FALCON) system to classify and locate cyber and physical anomalies, including false data injection attacks on protection devices, replay attacks on communication networks, and physical faults on distribution lines. The proposed system takes as input the transient short-circuit current and voltage measured by protection relays, the relays command status as well as the fault alarm from fault indicators, which is fed into a deep neural network that classifies and identifies the location of the fault and attacks in the distribution system. Numerical studies demonstrate FALCON's capability to classify and locate multiple cyber and physical anomalies with more than 98% accuracy, even when multiple devices are simultaneously compromised. Furthermore, the impact of different sets of input data is explored to highlight the importance of fault indicators, fault voltage data, and data collected from the RES relays.