提出双模块框架，精准识别差动保护系统中的隐蔽故障掩蔽攻击。
Unmasking Covert Intrusions: Detection of Fault-Masking Cyberattacks on Differential Protection Systems
- 基于线路物理模型构建测量不匹配指数，识别异常
- 神经网络分类器确认故障真实位置，避免误报
- 在真实电力系统仿真中验证实时性与抗干扰能力
线路电流差动继电器（LCDRs）是用于保护关键输电线路的高速继电器，但易受网络攻击。故障掩蔽攻击（FMAs）通过篡改目标LCDR的远程测量数据，隐藏保护线路上的真实故障，导致继电器无法触发。本文提出一种两模块检测框架：第一模块基于线路等效物理模型设计不匹配指数（MI），仅在本地与远程测量显著不一致而继电器未动作时触发，表明可能存在FMAs；第二模块采用神经网络分类器，快速判断触发事件是否为线路上的真实故障，从而确认是否存在攻击。该框架在IEEE 39节点基准系统上进行仿真验证，结果表明可准确检测FMAs，且不受正常系统扰动、参数变化或测量噪声影响。利用OPAL-RT实时仿真平台的实验进一步验证了方案的实时性能。
原文摘要 · Abstract (English)
Line Current Differential Relays (LCDRs) are high-speed relays progressively used to protect critical transmission lines. However, LCDRs are vulnerable to cyberattacks. Fault-Masking Attacks (FMAs) are stealthy cyberattacks performed by manipulating the remote measurements of the targeted LCDR to disguise faults on the protected line. Hence, they remain undetected by this LCDR. In this paper, we propose a two-module framework to detect FMAs. The first module is a Mismatch Index (MI) developed from the protected transmission line's equivalent physical model. The MI is triggered only if there is a significant mismatch in the LCDR's local and remote measurements while the LCDR itself is untriggered, which indicates an FMA. After the MI is triggered, the second module, a neural network-based classifier, promptly confirms that the triggering event is a physical fault that lies on the line protected by the LCDR before declaring the occurrence of an FMA. The proposed framework is tested using the IEEE 39-bus benchmark system. Our simulation results confirm that the proposed framework can accurately detect FMAs on LCDRs and is not affected by normal system disturbances, variations, or measurement noise. Our experimental results using OPAL-RT's real-time simulator confirm the proposed solution's real-time performance capability.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。