Patent ID: 11902318
Assignee: ALLIANCE FOR SUSTAINABLE ENERGY, LLC
Field: Digital communication (Electrical engineering)
Classification: CPC H  G  Y | IPC G  H

Claim 0:
1. A cyber-security system comprising:
a supervisory control and data acquisition (SCADA) network monitor configured to receive a first data set from a power system network;
a synchrophasor network monitor configured to receive time-stamped phasor data from the power system network;
an event manager; and
a mitigation system, wherein:
the SCADA network monitor comprises a first anomaly detector configured to:
compare the first data set to a modeled data set to identify in the first data set a first anomaly occurring in the power system network;
in response to identifying the first anomaly, generate a first alert signal corresponding to the first anomaly; and
send the first alert signal to the event manager;

the synchrophasor network monitor comprises a second anomaly detector configured to:
compare the time-stamped phasor data to a learning data set to identify in the time-stamped phasor data a second anomaly occurring in the power system network; and
in response to identifying the second anomaly, pass a second alert signal corresponding to the second anomaly to the event manager;

the event manager is configured to:
receive the first alert signal from the first anomaly detector;
receive the second alert signal from the second anomaly detector;
evaluate the first alert signal and the second alert signal;
determine if the first alert signal corresponds to at least one of a first intrusion or a first undesirable event;
determine if the second alert signal corresponds to at least one of a second intrusion and a second undesirable event;
in response to determining the first alert signal corresponds to the at least one of the first intrusion or the first undesirable event, pass the first alert signal to the mitigation system; and
in response to determining the second alert signal corresponds to at least one of the second intrusion or the second undesirable event, pass the second alert signal to the mitigation system; and

the mitigation system is configured to:
receive the first alert signal from the event manager;
receive the second alert signal from the event manager;
in response to receiving the first alert signal, perform a first corrective action affecting the power system network; and
in response to receiving the second alert signal, perform a second corrective action affecting the power system network.