A novel cyber‐attack modelling and detection in overcurrent protection relays based on wavelet signature analysis

Abstract

Abstract Cyber attacks can disrupt the digital protection relays and change their output command to the circuit breaker. The aim of this research is to provide new condition monitoring for overcurrent relays during cyber treatments. This research is modeled three common types of attacks with randomize concept and its detection method via MATLAB/SIMULINK software into IEEE 3‐machine 9‐bus model that is applicable in real time situation. Finally a new index has been defined for detection that employs wavelet analysis of the substation currents and its energy which has been called cyber attack detection index (CADI). Proposed index is robust to variation of sampling signal, sampling rate, cyber attack type and current transformer saturation. The results show that the index has an acceptable performance with accuracy of 100% without any false trigger. This method is not dependent on operating point, relay protection scheme and attack type and also could distinguish the abnormal actions of breakers due to unexpected cyber contingencies caused by natural disasters or software malfunctions rather than cyber attacks in a certain operating points. The level of CADI curve in cyber attacks is always higher than symmetrical fault and current signal detects them more quickly and clearly than other signals.

Keywords

• cyber‐physical systems
• discrete wavelet transforms
• overcurrent protection
• performance index