Patent ID: 11902318
Assignee: ALLIANCE FOR SUSTAINABLE ENERGY, LLC
Field: Digital communication (Electrical engineering)
Classification: CPC H  G  Y | IPC G  H

Claim 7:
8. A cyber-security method comprising:
receiving from a power system network:
a first data set via a supervisory control and data acquisition (SCADA) network monitor; and
time-stamped phasor data via a synchrophasor network monitor;

in a first anomaly detector:
comparing the first data set to a modeled data set to identify in the first data set a first anomaly occurring in the power system network; and
in response to identifying the first anomaly, generating a first alert signal corresponding to the first anomaly;

in a second anomaly detector:
receiving the first data set;
generating, from at least one of the first data set or the time-stamped phasor data, a learning data set;
comparing the time-stamped phasor data to the learning data set to identify in the time-stamped phasor data a second anomaly occurring in the power system network; and
in response to identifying the second anomaly, generating a second alert signal corresponding to the second anomaly;

sending the first alert signal and the second alert signal to an event manager;
evaluating, in the event manager, the first alert signal and the second alert signal;
determining, in the event manager, if the first alert signal corresponds to at least one of a first intrusion or a first undesirable event and if the second alert signal corresponds to at least one of a second intrusion or a second undesirable event;
in response to determining that at least one of the first alert signal corresponds to the at least one of the first intrusion or the first undesirable event or the second alert signal corresponds to the at least one of the second intrusion or the second undesirable event, passing, via the event manager, at least one of the first alert signal or the second alert signal to a mitigation system;
receiving, in the mitigation system, at least one of the first alert signal or the second alert signal; and
in the mitigation system, in response to receiving at least one of the first alert signal or the second alert signal, performing at least one of a first corrective action or a second corrective action affecting the power system network.