[论文解读] Catching Anomalous Distributed Photovoltaics: An Edge-based Multi-modal Anomaly Detection

Devu Manikantan Shilay, Kin Gwn Lorey+3 more|arXiv (Cornell University)|Sep 26, 2017

Smart Grid Security and Resilience参考文献 2被引用 14

一句话总结

本文提出了一种基于边缘计算的多模态异常检测框架，针对分布式光伏（PV）系统，利用电压、有功/无功功率注入以及电能质量指标的时间序列数据，通过无监督机器学习实现异常检测。主成分分析结合凸包（PCA with Convex Hull）方法表现出最强的鲁棒性，以83.64%的真正例率和95.78%的准确率检测出所有攻击类型，优于单一模型，在识别光伏系统多样化的网络物理攻击方面表现更优。

ABSTRACT

A significant challenge in energy system cyber security is the current inability to detect cyber-physical attacks targeting and originating from distributed grid-edge devices such as photovoltaics (PV) panels, smart flexible loads, and electric vehicles. We address this concern by designing and developing a distributed, multi-modal anomaly detection approach that can sense the health of the device and the electric power grid from the edge. This is realized by exploiting unsupervised machine learning algorithms on multiple sources of time-series data, fusing these multiple local observations and flagging anomalies when a deviation from the normal behavior is observed. We particularly focus on the cyber-physical threats to the distributed PVs that has the potential to cause local disturbances or grid instabilities by creating supply-demand mismatch, reverse power flow conditions etc. We use an open source power system simulation tool called GridLAB-D, loaded with real smart home and solar datasets to simulate the smart grid scenarios and to illustrate the impact of PV attacks on the power system. Various attacks targeting PV panels that create voltage fluctuations, reverse power flow etc were designed and performed. We observe that while individual unsupervised learning algorithms such as OCSVMs, Corrupt RF and PCA surpasses in identifying particular attack type, PCA with Convex Hull outperforms all algorithms in identifying all designed attacks with a true positive rate of 83.64% and an accuracy of 95.78%. Our key insight is that due to the heterogeneous nature of the distribution grid and the uncertainty in the type of the attack being launched, relying on single mode of information for defense can lead to increased false alarms and missed detection rates as one can design attacks to hide within those uncertainties and remain stealthy.

研究动机与目标

• 为解决针对电网边缘设备（如光伏系统）的网络物理攻击缺乏实时、分布式异常检测的问题。
• 通过实现对光伏设备行为及与电网交互的本地实时监控，提升配电网的态势感知能力。
• 通过融合多种数据模态而非依赖单一信号源，降低误报率和漏报率。
• 开发一种可扩展、可部署于边缘的检测系统，在检测到正常行为偏离时发出异常警报。

提出的方法

• 该框架从多个来源采集时间序列数据：微同步相量测量单元（µPMUs）提供的电压幅值和相角，智能电表提供的有功/无功功率注入/吸收数据，以及光伏逆变器提供的电能质量指标。
• 对每条数据流独立应用无监督机器学习模型（包括OCSVM、孤立森林、损坏随机森林、PCA与凸包结合、自编码器）进行异常检测。
• 采用MostAnomalous融合策略，通过在所有模型中选取最高异常评分来确定最终的异常标志。
• 利用GridLAB-D仿真环境，结合真实智能家居与光伏数据集，模拟了针对光伏系统的多种网络物理攻击。
• 特征工程包括从时间序列数据中提取时域特征和统计特征，以增强模型对细微偏差的敏感性。
• 通过F1分数、ROC-AUC、真正例率和准确率等指标，在四种攻击类型（断开、功率削减、电压无功调节、反向功率流动）下评估性能。

实验结果

研究问题

• RQ1 基于多模态、边缘计算的异常检测系统能否在实时条件下有效检测分布式光伏系统面临的多样化网络物理攻击？
• RQ2 与单模态方法相比，融合电压、功率和电能质量等多种数据流在多大程度上提升了检测性能？
• RQ3 在多种攻击类型下，哪种无监督机器学习算法表现出最强的鲁棒性且误报率最低？
• RQ4 设备行为与电网测量之间的物理相关性在多大程度上提升了检测准确性？
• RQ5 在不同攻击渗透率和正常电网波动条件下，该系统能否保持高检测准确率？

主要发现

• PCA与凸包结合的方法整体性能最优，对全部四种攻击类型实现了83.64%的真正例率和95.78%的准确率。
• OCSVM在检测电压无功调节攻击方面表现优异，ROC-AUC达到99.9%；而损坏随机森林在检测反向功率流动和断开攻击时，ROC-AUC分别达到97.27%和98.49%。
• 各独立模型在特定攻击类型上表现良好，但难以在所有攻击类型间实现泛化，凸显了多模态融合的必要性。
• 神经网络与自编码器模型表现欠佳，所有攻击类型和渗透率水平下的真正例率均低于0.5。
• 系统性能受限于1分钟采样周期和正常电压波动，表明更快采样频率和引入物理特征可能进一步提升检测能力。
• MostAnomalous融合策略有效整合了多个异常信号，降低了误报率并提高了检测可靠性。