Rule-Based Intrusion Detection System for SCADA Networks

Increased complexity and interconnectivity of Supervisory Control and Data Acquisition (SCADA) systems in Smart Grids potentially means greater susceptibility to malicious attackers. SCADA systems with legacy communication infrastructure have inherent cyber-security vulnerabilities as these systems were originally designed with little consideration of cyber threats. In order to improve cyber-security of SCADA networks, this paper presents a rule-based Intrusion Detection System (IDS) using a Deep Packet Inspection (DPI) method, which includes signature-based and model-based approaches tailored for SCADA systems. The proposed signature-based rules can accurately detect several known suspicious or malicious attacks. In addition, model-based detection is proposed as a complementary method to detect unknown attacks. Finally, proposed intrusion detection approaches for SCADA networks are implemented and verified using a ruled based method.

A New Principal Curve Algorithm for Nonlinear Principal Component Analysis

This paper emerged from work supported by EPSRC grant GR/S84354/01 and proposes a method of determining principal curves, using spline functions, in principal component analysis (PCA) for the representation of non-linear behaviour in process monitoring. Although principal curves are well established, they are difficult to implement in practice if a large number of variables are analysed. The significant contribution of this paper is that the proposed method has minimal complexity, assuming simple spline geometry, thus enabling efficient computation. The paper provides a foundation for further work where multiple curves may be required to represent underlying non-linear information in complex data.

Intrusion Detection System for Network Security in Synchrophasor Systems

Synchrophasor systems will play a crucial role in next generation Smart Grid monitoring, protection and control. However these systems also introduce a multitude of potential vulnerabilities from malicious and inadvertent attacks, which may render erroneous operation or severe damage. This paper proposes a Synchrophasor Specific Intrusion Detection System (SSIDS) for malicious cyber attack and unintended misuse. The SSIDS comprises a heterogeneous whitelist and behavior-based approach to detect known attack types and unknown and so-called ‘zero-day’ vulnerabilities and attacks. The paper describes reconnaissance, Man-in-the-Middle (MITM) and Denial-of-Service (DoS) attack types executed against a practical synchrophasor system which are used to validate the real-time effectiveness of the proposed SSIDS cyber detection method.

Intrusion Detection System for IEC 60870-5-104 Based SCADA Networks

Increased complexity and interconnectivity of Supervisory Control and Data Acquisition (SCADA) systems in Smart Grids potentially means greater susceptibility to malicious attackers. SCADA systems with legacy communication infrastructure have inherent cyber-security vulnerabilities as these systems were originally designed with little consideration of cyber threats. In order to improve cyber-security of SCADA networks, this paper presents a rule-based Intrusion Detection System (IDS) using a Deep Packet Inspection (DPI) method, which includes signature-based and model-based approaches tailored for SCADA systems. The proposed signature-based rules can accurately detect several known suspicious or malicious attacks. In addition, model-based detection is proposed as a complementary method to detect unknown attacks. Finally, proposed intrusion detection approaches for SCADA networks are implemented and verified via Snort rules.

Large-Scale Wind Generator Cascaded Tripping

Large scale wind farms are subject to tripping, as a consequence of turbine failure, over-sensitive protection, turbines not equipped with low-voltage ride through (LVRT), and reactive power compensation device defects which can lead to voltage rises. This paper considers pertinent issues which render tripping based on a study of LVRT and wind farm protection, with methods to avoid large scale wind generator tripping proposed. The results of LVRT field tests in Jiuquan, China in December 2012 show that the proposed approaches are effective. The paper also presents work which proposes an early warning system to forecast the risk of wind power tripping.

Application of PMUs to Coordinate Hydroelectric and Wind Power Plant Operation

It is acknowledged that wind power is a stochastic energy source compared to hydroelectric generation which is easily scheduled. In this paper a scheme for coordinating wind power plant and hydroelectric power plant is presented by using PMUs to measure and control the state of wind and hydro power plants. Hydroelectric generation is proposed as a method of energy reserve and compensation in the context of wind power fluctuation in order to avoid full or partial curtailment of wind generation to benefit wind providers. The feasibility of this proposed scheme is investigated by power flow calculation and stability analysis using the IEEE 30-bus power system model.

Voltage and power quality improvement strategy for a DFIG wind turbine during variable wind conditions

This paper presents a voltage and power quality enhancement scheme for a doubly-fed induction generator (DFIG) wind farm during variable wind conditions. The wind profiles were derived considering the measured data at a DFIG wind farm located in Northern Ireland (NI). The aggregated DFIG wind farm model was validated using measured data at a wind farm during variable generation. The voltage control strategy was developed considering the X/R ratio of the wind farm feeder which connects the wind farm and the grid. The performance of the proposed strategy was evaluated for different X/R ratios, and wind profiles with different characteristics. The impact of flicker propagation along the wind farm feeder and effectiveness of the proposed strategy is also evaluated with consumer loads connected to the wind farm feeder. It is shown that voltage variability and short-term flicker severity is significantly reduced following implementation of the novel strategy described.

Analysis of Fixed-Speed Wind Farm Low-Frequency Power Pulsations using a Wavelet-Prony Method

The increasing penetration of wind generation on the Island of Ireland has been accompanied by close investigation of low-frequency periodic pulsations contained within the active power flow from different wind farms. A primary concern is excitation of existing low-frequency oscillation modes already present on the system, particularly the 0.75 Hz mode as a consequence of the interconnected Northern and Southern power system networks. Recently grid code requirements on the Northern Ireland power system have been updated stipulating that wind farms connected after 2005 must be able to control the magnitude of oscillations in the range of 0.25 - 1.75 Hz to within 1% of the wind farm's registered output. In order to determine whether wind farm low-frequency oscillations have a negative effect (excite other modes) or possibly a positive impact (damping of existing modes) on the power system, the oscillations at the point of connection must be measured and characterised. Using time - frequency methods, research presented in this paper has been conducted to extract signal features from measured low-frequency active power pulsations produced by wind farms to determine the effective composition of possible oscillatory modes which may have a detrimental effect on system dynamic stability. The paper proposes a combined wavelet-Prony method to extract modal components and determine damping factors. The method is exemplified using real data obtained from wind farm measurements.

Optimization of FRT Active Power Performance of a DFIG during Transient Grid Faults

Optimal fault ride-through (FRT) conditions for a doubly-fed induction generator (DFIG) during a transient grid fault are analyzed with special emphasis on improving the active power generation profile. The transition states due to crowbar activation during transient faults are investigated to exploit the maximum power during the fault and post-fault period. It has been identified that operating slip, severity of fault and crowbar resistance have a direct impact on the power capability of a DFIG, and crowbar resistance can be chosen to optimize the power capability. It has been further shown that an extended crowbar period can deliver enhanced inertial response following the transient fault. The converter protection and drive train dynamics have also been analyzed while choosing the optimum crowbar resistance and delivering enhanced inertial support for an extended crowbar period.

Active use of DFIG based Wind Farms for Transient Stability Improvement during Grid Disturbances

The doubly-fed induction generator (DFIG) now represents the dominant technology in wind turbine design. One consequence of this is limited damping and inertial response during transient grid disturbances. A dasiadecoupledpsila strategy is therefore proposed to operate the DFIG grid-side converter (GSC) as a static synchronous compensator (STATCOM) during a fault, supporting the local voltage, while the DFIG operates as a fixed-speed induction generator (FSIG) providing an inertial response. The modeling aspects of the decoupled control strategy, the selection of protection control settings, the significance of the fault location and operation at sub- and super-synchronous speeds are analyzed in detail. In addition, a case study is developed to validate the proposed strategy under different wind penetrations levels. The simulations show that suitable configuration of the decoupled strategy can be deployed to improve system voltage stability and inertial response for a range of scenarios, especially at high wind penetration. The conclusions are placed in context of the practical limitations of the technology employed and the system conditions.

Determination of Power System Response during Small Load Fluctuations

This paper proposes a calculation method to determine power system response during small load perturbations or minor disturbances. The method establishes the initial value of active power transient using traditional reduction technique on admittance matrix, which incorporates voltage variations in the determination. The method examines active power distribution among generators when several loads simultaneously change, and verifies that the superposition principle is applicable for this scenario. The theoretical derivation provided in the paper is validated by numerical simulations using a 3-generator 9-bus benchmark model. The results indicate that the inclusion of voltage variation renders an independent and precise measure of active power response during transient conditions.

Measurement-based Method for Wind Farm Power System Oscillation Monitoring

The global increase in the penetration of renewable energy is pushing electrical power systems into uncharted territory, especially in terms of transient and dynamic stability. In particular, the greater penetration of wind generation in European power networks is, at times, displacing a significant capacity of conventional synchronous generation with fixed-speed induction generation and now more commonly, doubly-fed induction generators. The impact of such changes in the generation mix requires careful monitoring to assess the impact on transient and dynamic stability. This paper presents a measurement based method for the early detection of power system oscillations, with attention to mode damping, in order to raise alarms and develop strategies to actively improve power system dynamic stability and security. A method is developed based on wavelet transform and support vector data description (SVDD) to detect oscillation modes in wind farm output power, which may excite dynamic instabilities in the wider system. The wavelet transform is used as a filter to identify oscillations in different frequency bands, while SVDD is used to extract dominant features from different scales and generate an assessment boundary according to the extracted features. Poorly damped oscillations of a large magnitude or that are resonant can be alarmed to the system operator, to reduce the risk of system instability. Method evaluation is exemplified used real data from a chosen wind farm.

Modal Extraction for Wind Turbines using Moving Window Subspace Identification

This paper proposes a method for wind turbine mode identification using the multivariable output error statespace (MOESP) identification algorithm. The paper incorporates a fast moving window QR decomposition and propagator method from array signal processing, yielding a moving window subspace identification algorithm. The algorithm assumes that the system order is known as a priori and remains constant during identification. For the purpose of extracting modal information for turbines modelled as a linear parameter varying (LPV) system, the algorithm is applicable since a nonlinear system can be approximated as a piecewise time invariant system in consecutive data windows. The algorithm is exemplified using numerical simulations which show that the moving window algorithm can track the modal information. The paper also demonstrates that the low computational burden of the algorithm, compared to conventional batch subspace identification, has significant implications for online implementation.