The U.S. Department of Homeland Security (DHS) has recently identified digital relays as targets vulnerable to cyber-attacks. The DHS has also noted that attacks to multiple relays can bring about cascading outages of transmission lines, leading to blackouts. As a result, making protective relays cyber-resilient is a prominent security issue in power networks. Line current differential relays (LCDRs) are among the potentially vulnerable digital relays that are increasingly deployed for protecting critical transmission lines. LCDRs, however, lack the required resiliency against cyber attacks, due to their high dependence on communication systems. This paper unveils that such susceptibilities can result in unwarranted trip signals through false data injection attacks (FDIAs), and so cause instability if several attacks are coordinated. It also presents a solution for detecting FDIAs and distinguishing them from real internal faults. To detect attacks, the proposed method compares the estimated and locally measured voltages at an LCDR's terminal for both the positive sequence (PS) and negative sequence (NS). To estimate the local voltage for each sequence, the proposed technique uses an unknown input observer (UIO), the state-space model of the faulty line, and remote and local measurements, all associated with that sequence. The difference between the measured and estimated local voltages for each sequence remains close to zero during real internal faults because, in this condition, the state-space model based on which the UIO operates correctly represents the line. Nevertheless, the state-space model mismatch during FDIAs leads to a large difference between measured and estimated values in both sequences. The effectiveness of the proposed method is corroborated using simulation results for the IEEE 39-bus network.

The application of line current differential relays (LCDRs) to protect transmission lines has recently proliferated. However, the reliance of LCDRs on digital communication channels has raised growing cyber-security concerns. This paper investigates the impacts of false data injection attacks (FDIAs) on the performance of LCDRs. It also develops coordinated attacks that involve multiple components, including LCDRs, and can cause false line tripping. Additionally, this paper proposes a technique for detecting FDIAs against LCDRs and differentiating them from actual faults in two-terminal lines. In this method, when an LCDR detects a fault, instead of immediately tripping the line, it calculates and measures the superimposed voltage at its local terminal, using the proposed positive-sequence (PS) and negative-sequence (NS) submodules. To calculate this voltage, the LCDR models the protected line in detail and replaces the rest of the system with a Thevenin equivalent that produces accurate responses at the line terminals. Afterwards, remote current measurement is utilized by the PS and NS submodules to compute each sequence's superimposed voltage. A difference between the calculated and the measured superimposed voltages in any sequence reveals that the remote current measurements are not authentic. Thus, the LCDR's trip command is blocked. The effectiveness of the proposed method is corroborated using simulation results for the IEEE 39-bus test system. The performance of the proposed method is also tested using an OPAL real-time simulator.

False data injection attacks (FDIAs) against the automatic generation control (AGC) system can lead to unstable or non-optimal operation of the power grid. This paper introduces a method to detect FDIAs targeting the AGC system by developing a stochastic unknown input estimator (SUIE). The SUIE estimates the states of the load-frequency control system, which contains the AGC as a control loop. An increase in the SUIE's residual function (RF) beyond a defined threshold signifies an FDIA. The SUIE can be designed such that it works independently from some or all inputs to the system's state-space model. In addition, the effect of process and measurement noise on the estimated states is minimized through an optimal gain setting technique for the SUIE. Therefore, not only does the SUIE eliminate the need for information about real-time load changes throughout the grid, it also maximizes the state estimation accuracy. The combination of these features distinguishes the proposed method from existing FDIA detection techniques for the AGC system. This paper also develops a number of attack identification SUIEs (AISUIEs) to determine which measurements are compromised by an FDIA, thus facilitating FDIA mitigation strategies. The AISUIEs model FDIAs targeting each AGC measurement by an attack input. These inputs serve as the unknown inputs of different AISUIEs, whose RFs indicate the type of attack. The designed AISUIEs also differentiate between attacks and non-attack abnormalities such as faults. Simulation analysis of a three-area power system corroborates the effectiveness of the proposed method. In addition, the performance of the proposed method is tested using an OPAL real-time simulator, and is compared with another technique from the literature.

The proliferation of distributed energy resources is setting the stage for modern distribution systems to operate as microgrids, which can avoid power disruptions and serve as resources for fast recovery during macrogrid disturbances. Microgrids are, therefore, major assets to improve the grid resilience. However, the offered resilience is seriously undermined if microgrids are not properly protected in the event of faults within their own boundaries. Distribution protective devices cannot reliably protect microgrids due to the variable and often limited short-circuit capacities of microgrids. Moreover, the research on microgrid protection has not led to a commercially available microgrid relay to date and has little prospect of reaching that level in the near future. As a result, the existing options for reliable microgrid protection remain effectively the subtransmission and transmission system protective devices, e.g., directional overcurrent, distance, and differential relays. Although years of operation in macrogrids support these relays, their performance for microgrids is yet to be analyzed. This paper presents such analysis for different relay types by considering various fault and generation conditions in a microgrid. Time-domain simulations are used to identify the scenarios where the relays function correctly as well as the problematic conditions, on which future research should focus. This paper also presents a short review on direct current (dc) microgrids and their protection requirements.