Detecting dynamic load altering attacks: A data-driven time-frequency analysis

In this paper, we focus on the problem of detecting Dynamic Load Altering Attacks (D-LAAs) in power systems from raw data of smart meters and without knowledge of the power system dynamics. The detection of D-LAA solely based on the smart meter readings is addressed in the frequency domain. We show that a D-LAA is detectable through a frequency domain analysis, and that the attack signature corresponds to the system poles that are relocated by the D-LAA feedback. We provide conditions on the time resolution of the smart meters to ensure attack detection, and we highlight the potential for interference from instrumentation and communication devices. For the case when smart meter readings and frequency measurements are both available, we show that a cross-correlation analysis allows to detect D-LAA, and to distinguish between D-LAAs and the effect of benign frequency responsive loads. We conclude that depending on the attack implementation and the type of data available, both time-domain and frequency-domain detection analysis may be needed to ensure accurate attack detection.