Sampled Value Attack Detection for Busbar Differential Protection Based on a Negative Selection Immune System

Abstract

Considering a variety of sampled value (SV) attacks on busbar differential protection (BDP) which poses challenges to conventional learning algorithms, an algorithm to detect SV attacks based on the immune system of negative selection is developed in this paper. The healthy SV data of BDP are defined as self-data composed of spheres of the same size, whereas the SV attack data, i.e., the nonself data, are preserved in the nonself space covered by spherical detectors of different sizes. To avoid the confusion between busbar faults and SV attacks, a self-shape optimization algorithm is introduced, and the improved self-data are verified through a power-frequency fault-component-based differential protection criterion to avoid false negatives. Based on the difficulty of boundary coverage in traditional negative selection algorithms, a self-data-driven detector generation algorithm is proposed to enhance the detector coverage. A testbed of differential protection for a 110 kV double busbar system is then established. Typical SV attacks of BDP such as amplitude and current phase tampering, fault replays, and the disconnection of the secondary circuits of current transformers are considered, and the delays of differential relay operation caused by detection algorithms are investigated.

Keywords

• Cyberattack
• busbar differential protection (BDP)
• negative selection
• self-data-driven detector
• sampled value attacks
• internal faults