Smart cyber-attack diagnosis and mitigation in a wind farm network operator

The distribution of datasets shows a strong reliance on SWaT and WADI for benchmarking prediction-residual-based methods, with additional evidence from custom-built avionics, robotics, temperature-control, offshore wind farm, and simulation-based CPS testbeds.

“Finally, the distribution of datasets shows a strong reliance on SWaT and WADI for benchmarking prediction-residual-based methods, with additional evidence from custombuilt avionics, robotics, temperature-control, offshore wind farm, and simulation-based CPS testbeds [67-73,75,76].”

Under ramp attacks on frequency measurements or ramp/scaling attacks on the required active power commands sent by the WFNO, only the residual corresponding to the attacked signal increases selectively.

“Under normal operation, both residuals remain small; however, under ramp attacks on frequency measurements or ramp/scaling attacks on the required active power commands sent by the WFNO, only the residual corresponding to the attacked signal increases selectively.”

The method by Badihi et al. [73] detects anomalies by analyzing which residual channel exceeds its threshold and uses the residuals to automatically adjust the active power control input, thereby detecting and mitigating cyberattacks early before the grid frequency significantly deviates from its allowable range.

“The method thus detects anomalies by analyzing which residual channel exceeds its threshold and uses the residuals to automatically adjust the active power control input, thereby detecting and mitigating cyberattacks early-before the grid frequency significantly deviates from its allowable range.”

Prediction-residual-oriented methods are powerful for detecting subtle and coordinated process anomalies, including multi-point stealthy attacks that forge SCADA histories or slowly drive the system toward unsafe states.

“Third, in terms of detection capability and failure modes, the results indicate that prediction-residual-oriented methods are powerful for detecting subtle and coordinated process anomalies, including multi-point stealthy attacks that forge SCADA histories or slowly drive the system toward unsafe states [69,72,73,75,76].”

In many works, a model predicts the next-step sensor or control-signal values and computes prediction residuals, or derives an anomaly score that functions as a probabilistic or density-based residual, so that small but systematic deviations in process dynamics can be detected even when they are not visible at the network layer.

“In many of these works, a model predicts the next-step sensor or control-signal values and computes prediction residuals, or derives an anomaly score that functions as a probabilistic or density-based residual, so that small but systematic deviations in process dynamics can be detected even when they are not visible at the network layer [67,69,70,72,73,75].”

Process data are particularly suitable for attacks that perturb the physical process state while keeping network-level statistics relatively unchanged, such as false data injection, malicious command or parameter manipulation, process-oriented attacks, and stealthy drifts in sensor trajectories.

“First, process data are particularly suitable for attacks that perturb the physical process state while keeping network-level statistics relatively unchanged-such as false data injection, malicious command or parameter manipulation, process-oriented attacks, and stealthy drifts in sensor trajectories [67,69-73,75,76].”

Badihi et al. [73] proposed a prediction-residual-based cyberattack diagnosis and mitigation method that simultaneously monitors grid frequency and active power reference signals observed by the Wind Farm Network Operator (WFNO) for offshore wind farm data.

“For offshore wind farm data, Badihi et al. [73] proposed a prediction-residual-based cyberattack diagnosis and mitigation method that simultaneously monitors grid frequency and active power reference signals observed by the Wind Farm Network Operator (WFNO).”