Machine Learning Techniques to Detect GPS Spoofing Attacks in the Wide-Area Monitoring System (WAMS) for Power Systems
The increasingly pervasive installation of Phasor Measurement Units (PMUs) in recent years has dramatically changed the landscape of power grid monitoring and control. To date, there are 2,500 PMUs at key locations of North American power grid, such as major transmission inter-connections, key generation plants, substations, and major load centers to form a wide-area monitoring system (WAMS) for our power grid. More and more control room applications are starting to integrate these high-resolution synchronized measurements to improve the grid reliability and efficiency. However, this also introduces great concerns about the cyber security of the synchrophasor measurements generated by PMUs. The civilian GPS signal utilized in PMU is publicly known and readily predictable, and this makes GPS-based timestamp synchronization vulnerable to GPS spoofing attack (GSA), which hijacks the PMU by faking the GPS signal and compromises the reliability of all the synchrophasor data provided by this PMU.
Figure 1: A hypothetical GPS spoofing attack scenario.
This image, titled "project-based-training-machine-learning-techniques-to-detect-gps-spoofing-attacks," is a complex graphic illustrating the threat of GPS Spoofing Attacks (GSA) on the North American Power Grid.The graphic is divided into three main components:Top-Left/Center Threat Illustration:A prominent red arrow points from the concept of a GSA attack towards an image of a control room monitor wall, with the text: "GPS Spoofing Attack (GSA) will mislead automated protection systems and grid operators!!!"To the right, a diagram shows the attack vector: A GPS Time Network transmits signals to a device (implied to be a Phasor Measurement Unit or PMU) at a power plant's generation stage. A Hypothetical GSA Drone is depicted intercepting/spoofing this signal, introducing malicious data (indicated by a large red arrow) into the grid's control system across the Transmission, Distribution, Substation, and End use stages.Bottom-Left Map of PMUs:A map of the contiguous United States and parts of southern Canada shows the locations of Phasor Measurement Units (PMU) within the North American Power Grid.The map uses three legend symbols:PMU Locations (blue circles).Transmission Owner Data Concentrator (yellow stars).Regional Data Concentrator (red stars).The map is dense with these symbols, illustrating the widespread use of PMU technology for grid monitoring. The image includes the logo for NASPI (North American SynchroPhasor Initiative).Bottom-Right Synthesized GSA Plot:A line graph, enclosed in a red dashed box, shows the simulated effect of a GSA on a PMU.The title is: "Synthesized GSA on PMU at Bus 7 from 3s to 10s"The y-axis is labeled "GSA Phase Shift (degree)" and ranges from 0 to 60.The x-axis is labeled "time (s)" and ranges from 0 to 9.The plot shows a flat line at 0 degrees from $t=0$s to $t=3$s. From $t=3$s to $t=10$s (the end of the visible graph), the line rises linearly, illustrating a steady, misleading phase shift being introduced by the spoofing attack.
This mini project aims at improving the cyber-resilience of power grid operations and applications that rely on GPS-based timing. This is achieved by online detection of GPS spoofing attacks (GSA) and incorporation of adaptive remedial actions for this kind of cyber-attack. The main idea is to apply machine learning techniques on the historical data to build a general model for the normal operations of the WAMS and then conduct online detection of GPS spoofing attacks by checking the discrepancy between the online measurement data reported by the PMUs and the trained model.
