IEEE Power & Energy Magazine - May/June 2019 - 46

WAMPAC Detection Method
the pMU data collected by the pdc controlling an hvdc
station can vary because different WaMpac applications
may require different pMU signals. even for a single WaMpac application, the controller can be designed to use different types of signals. For example, Wadc is a typical
WaMpac application that leverages hvdc for dampening
interarea oscillations in interconnected bulk power systems.
the Wadc can be designed to use voltage angle differences
between two remote buses as well as the frequency differences of two areas. in this sense, the detection algorithm can
be developed for a particular set of pMU data and a particular controller, or it can be designed to be generally applicable
for varying applications and controller configurations. ideally, the detection algorithm should satisfy several requirements on execution time, configuration flexibility, and ease
of implementation and maintenance.
While there are numerous detection methods to analyze
the network traffic and ports from the it perspective, physicsbased methods similar to those described previously for the
Scada networks are potentially viable detection solutions.
consider the existing physics-based methods for WaMpac
applications, which are generally associated with one of two
groups: data-based methods and model-based methods.
data-based detection methods mainly employ learningbased algorithms to identify patterns from the physical quantities under various operation conditions and then detect the
abnormal pattern from a real-time data stream. to train the
algorithm, the detector must be provided with a set of historical data containing system states under both normal and
attack conditions. the detector can then approximate the
input data (e.g., voltage and current phasors, frequency) and
output data (e.g., detection status) using its built-in activation
functions, even though the system model is not provided.
once the detection algorithm is properly trained, it can be
used to monitor real-time data and continue training itself

using the most recently updated data. the performance of
data-based methods relies on the selection of a training data
set and an activation function. the normal condition data are
easily collected, because both the simulated and practical
hvdc systems usually operate in normal conditions. attackcondition data are difficult to collect from practical hvdc
systems, largely because of the rarity and wide variety of
cyberattacks. thus, data-based methods may be difficult to
train reliably.
rule-based detection methods check the data integrity
of physical quantities using physical laws and available system model information. the rules used for detection can be
categorized into two types: self-check rules and cross-check
rules. Self-check rules can be used to check the reasonable
range of any physical quantities. cross-check rules can be
used to identify abnormal values from a set of redundant values. Because a pdc can collect signals from multiple pMUs
drawing from the same circuit, the measured physical quantities are inherently interdependent and obey physical laws,
such as circuit equations. these physical laws can be used to
construct a set of rules to check the integrity of pMU signals
tagged with the same time stamp. For example, if all current
measurements at the hvdc station are available, we can use
Kirchhoff's current law to check whether the sum of all of
the current phasors is close to zero at a given node. otherwise, an alarm should be triggered to notify the controller
that abnormal current measurements have been observed.
there are several advantages to using a rule-based method.
First, it does not require a predefined training set, although
historical data may be used for tuning the threshold parameters. another advantage of the rule-based method is that
compromised signals can be identified based on the analysis
of violated rules. lastly, the rule-based method requires only
a small amount of execution time because it simply needs to
substitute the input physical quantities into the equations of
each rule and then compare results with the threshold.

PDC Data Stream
Detector
Detection Status
WAMS
Data Stream

PDC
Estimated
Signal

Input Selector
If Under Attack Condition

Original Signal

HVdc-Based
WAMPAC
Applications

If Under Normal Condition

figure 5. The detection and mitigation framework for HVdc-based WAMPAC applications. WAMS: wide-area monitoring
system.
46

ieee power & energy magazine

may/june 2019

IEEE Power & Energy Magazine - May/June 2019

Table of Contents for the Digital Edition of IEEE Power & Energy Magazine - May/June 2019