Cited by 180Power System Optimization and StabilitySmart Grid Security and ResiliencePower Systems Fault Detection

Classification of disturbances and cyber-attacks in power systems using heterogeneous time-synchronized data

Pan, Shengyi, Morris, Thomas, Adhikari, Uttam·2015·IEEE Transactions on Industrial Informatics

Abstract

Visualization and situational awareness are of vital importance for power systems, as the earlier a power-system event such as a transmission line fault or cyber-attack is identified, the quicker operators can react to avoid unnecessary loss. Accurate time-synchronized data, such as system measurements and device status, provide benefits for system state monitoring. However, the time-domain analysis of such heterogeneous data to extract patterns is difficult due to the existence of transient phenomena in the analyzed measurement waveforms. This paper proposes a sequential pattern mining approach to accurately extract patterns of power-system disturbances and cyber-attacks from heterogeneous time-synchronized data, including synchrophasor measurements, relay logs, and network event monitor logs. The term common path is introduced. A common path is a sequence of critical system states in temporal order that represent individual types of disturbances and cyber-attacks. Common paths are unique signatures for each observed event type. They can be compared to observed system states for classification. In this paper, the process of automatically discovering common paths from labeled data logs is introduced. An included case study uses the common path-mining algorithm to learn common paths from a fusion of heterogeneous synchrophasor data and system logs for three types of disturbances (in terms of faults) and three types of cyber-attacks, which are similar to or mimic faults. The case study demonstrates the algorithm's effectiveness at identifying unique paths for each type of event and the accompanying classifier's ability to accurately discern each type of event.

Integrity signals

Registry

Crossref · 10.1109/tii.2015.2420951

Cites

29 of 29 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

This paper’s full text isn’t openly available, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Many hybrid data fusion-based anomaly detection approaches explicitly synchronize cyber-layer events with physical-layer behavior on a common time axis to detect cyber-physical inconsistencies that single-domain detectors would miss.

    “First, many approaches explicitly synchronize cyber-layer events with physical-layer behavior on a common time axis to detect cyber-physical inconsistencies that single-domain detectors would miss [122-129].”

Cites

Flagged first, then by citations

Cited by

Sorted by citations

Authors
Pan, S., Morris, T., & Adhikari, U.
Affiliations
Mississippi State University (US)
Venue
IEEE Transactions on Industrial Informatics
Published
2015-06
Volume
11
Issue
3
Pages
650-662
ISSN
  • 1551-3203 (ISSN-L)
  • 1941-0050
OpenAlex
W2020524857
Cited by
180
References
29
Citations by year
2026: 19 · 2025: 16 · 2024: 17 · 2023: 30 · 2022: 17 · 2021: 16 · 2020: 17 · 2019: 19 · 2018: 7 · 2017: 16 · 2016: 4 · 2015: 2
FWCI
4.66
Type
journal article
Language
en
Open access
closed
Locations
IEEE Transactions on Industrial Informatics (publishedVersion)
Funders
Division of Undergraduate Education (1315726)
Topics
  • Physical Sciences › Engineering › Electrical and Electronic Engineering › Power System Optimization and Stability
  • Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
  • Physical Sciences › Engineering › Control and Systems Engineering › Power Systems Fault Detection
Keywords
cyberattack detection, sequential pattern mining, synchrophasor measurements, fault classification, situational awareness

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review