Real Time Stream Mining based Attack Detection inDistribution Level PMUs for Smart Grids
Prithwiraj Roy† , Shameek Bhattacharjee‡ , and Sajal K. Das†
† Department of Computer Science, Missouri University of Science and Technology, Rolla, USA‡ Department of Computer Science, Western Michigan University, Kalamazoo, USA

E-mail: przhr@mst.edu; shameek.bhattacharjee@wmich.edu; sdas@mst.edu
Abstract—Reliable automation of smart grids depends on
decisions based on situational awareness extracted via real timesystem monitoring and accurate state estimation. The Phasor
Measurement Units (PMU) at distribution and transmission layers of the smart grid provide high velocity real time information
on voltage and current magnitudes and angles in a three phaseelectrical grid. Naturally, the authenticity of the PMU data is
of utmost operational importance. Data falsification attacks on
PMU data can cause the Energy Management Systems (EMS)
to take wrong decisions, potentially having drastic consequenceson the power grid’s operation. The need for an automateddata falsification attack detection and isolation is key for EMS
protection from PMU data falsification. In this paper, we propose
an automated distributed stream mining approach to time series
anomaly based attack detection that identifies attacks while
distinguishing from legitimate changes in PMU data trends.
Specifically, we provide a real time learning invariant that reduces
the multi-dimensional nature of the PMU data streams forquick big data summarization using a Pythagorean means of theactive power from a cluster of PMUs. Thereafter, we propose amethodology that learns thresholds of the invariant automatically,
to prove the predictive power of distinguishing between small
attacks versus legitimate changes. Extensive simulation results
using real PMU data are provided to verify the accuracy of the
proposed method.
Index Terms—Smart Grid Security, Phasor Measurement Units
Security, Big Data Management, Anomaly Detection.

I. I NTRODUCTION
Traditionally, power grid operators had limited information
about dynamically varying system states in the grid. Many
major faults in the grid are usually preceded by ephemeral
warning signs (e.g., voltage sags) that Supervisory Control
And Data Acquisition (SCADA) measurements (with data
resolution of several seconds) could not capture as shownin [11]. To alleviate this problem, PMUs are deployed tocapture fine grained high resolution time series data. These
PMUs form the crucial endpoint device for the PMU Infrastructure, one of the key cornerstones of the modern smart griddesign. Furthermore, with the increasing market penetrationof Distributed Energy Resources (DERs) (e.g. solar panels),
two-way electricity flows, and novel loads (such as electricvehicles), the grid requires real time grid monitoring, making
the integrity of PMU data streams of strategic importance.
The PMUs record time-synchronized measurements of voltage, current, phase angle and frequency (collectively known
as synchrophasor data) and sends it to an aggregator called

Phasor Data Concentrator (PDC). The PDC, in turn, relays
such data to a control center, allowing grid operators to localize
and infer the type, time and location of a fault or disturbanceas well as support critical control-actuation operations suchas state estimation, maintain optimal power flow, based on
the measured PMU data streams. The architecture of a typical
PMU-PDC infrastructure is shown in Fig. 1.

Figure 1: Architecture of a PMU Infrastructure.
However, in recent years, power distribution systems have
faced cyber-attacks, threatening their security, reliability ofoperations. The report of US National Research Council highlights potential multi-state blackouts as a result of coordinatedFalse Data Injection (FDI) attacks on power systems [2]. Suchan attack on the Ukrainian power grid resulted in the loss ofservice for approximately 225,000 customers in three different
territories which lasted for several hours [3]. Stuxnet worm has
directly affected more than 100,000 industrial components [4].
However, the widely accepted IEEE C37.118-2 protocol forsynchrophasor communication is highly vulnerable to cyberattacks [6], [8]. In fact, most synchrophasor data transmission
happen on non-reliable and insecure IP networks. Heavy
encryption is not possible due to the latency critical natureof PMU data applications, thus increasing the chances of FDI
attacks. This motivates the need for anomaly based intrusion
detection in PMUs. While some existing research [7], [14]offer solutions, they have the following limitations: [7] focus
on transmission layer PMUs, where data is very stable, thus
making anomaly detection easy. The [5] considers the problem
of only voltage data falsification, which is stable and henceeasy to detect, ignoring current data falsification.
In this paper, we first discuss multiple attack strategies
for data falsification attacks in PMUs. Then, we propose
a process variable selection that reduces the dimensionality

of the anomaly detection problem. Then, we use a ratio of
harmonic means to arithmetic means of the active power
derived from the synchrophasor data sent from PMUs as adata-driven ‘invariant’ for anomaly detection. Specifically, we
find the appropriate spatial and temporal considerations of
the PMU network, such that an ‘invariant’ is highly stable
under no attacks but shows unique changes under various
kinds of data falsification attacks. Then, we propose a twotier threshold based detection criterion involving stateless andstateful residuals of the anomaly detection metric, that better
improve the false alarm versus detection sensitivity trade-off.
The two-tier detector uses the sum of long term residuals
from the median absolute deviation of the ratio based metricobserved over the training phase. Finally, we validate our workby using real PMU datasets collected from Lawrence Berkley
National Lab across 12 days.
The main benefits of our approach are to provide a practicalframework for compromised PMU identification that (i) realtime, light weight, semi- supervised, (ii) enables quick identification, and (iii) simultaneously works for a variety of data
falsification attack types.
The rest of this paper is organized as follow. Section II,
discusses related work. Section III discusses PMU dataset
description, system and threat models, Section IV presents
the proposed detection framework, Section V and VI offers
experimental results and conclusions, respectively.
II. R ELATED W ORK
In [7], a mechanism based on continuous monitoring ofphase-wise equivalent transmission line impedance was proposed, for detecting data falsification on the voltage data fromtransmission system PMUs. However, they require two PMUs
deployed at both ends of the transmission line and one ofthem needs to be honest. More importantly, we found that the
PMU data streams at transmission level were inherently stablemaking anomaly detection a less challenging problem.
In [5] a Support Vector Machine (SVM) was used for detection, against a mirroring spoof attack strategy on the voltage
data at distribution level PMUs. However, only falsification ofvoltage stream was considered which is relatively stable andmakes anomaly detection less challenging.
The [9] proposed a decision tree based anomaly detection
scheme to differentiate between normal tripping and malicious
tripping by training on specific attack samples. However, it is
not feasible to generate 100% of all the possible legitimateline tripping cases for training in [9].
In [14] a smart Time Synchronization Attack (TSA) basedon GPS spoofing was shown to be equivalent to modifying thephase angle measurement from PMUs. However, they have notdiscussed any defense mechanism.
In [13] a density-based local outlier factor (LOF) analysis
was used to detect the anomalies among the data, to describe
spatio-temporal outliers among all the synchrophasor measurements from the grid. However, this method might not be able
to detect attacks in real time and in their proposed method theauthors have only considered an attack on voltage magnitude.

A critical analysis of all previous works on the detectionof PMU data falsification revealed that current data falsification for PMU streams was not investigated. Furthermore, we
found that unlike transmission level PMUs, the distribution
level PMU’s current synchrophasor data shows high dynamic
variations in benign conditions, making anomaly detection
challenging. Finally, all previous defenses are stream specificin the sense that they only work for either voltage or phasefalsification. Since each PMU contains 4 streams and has 3phases, a stream specific defense will require 12 different
defense models that need complex cross-coordination.
III. S YSTEM AND T HREAT M ODELS
A. PMU System Architecture
Here we first describe the PMU infrastructure networkarchitecture. Most PMUs measure time-stamped voltages andcurrent magnitudes and their phase angles denoted by Vt (j),It (j), θtV (j), θtI (j) respectively, where t is the time stamp
and j is the j-th phase. These PMUs are deployed at strategic
points of the transmission and distribution layers of the smart
grid. Each PMU sends its data to a regional decentralized
data aggregator known as PDC. The corresponding PDC inturn relays the aggregated data from multiple PMUs to a
Local Controller Center (LCC). Various local controller centerscommunicate with each other forming a wide network forsynchronizing local and global PMU data. In this paper, weare specifically interested in a decentralized anomaly detectionthat runs on a PDC or a LCC and facilitates early attack
detection from a bunch of PMUs that are geographicallyproximate in terms of the PMU network.
Dataset Description: We use a dataset collected from thePower Standards Lab (PSL) at LBNL in Berkeley, CA, whichdeveloped high-precision µ-PMUs for showing how steps in
our framework related to a real PMU system. The LBNL
dataset contains three µ-PMUs that are deployed at multiple
utility and LBNL campus locations on 12 kV distribution grid.
The µ-PMU devices are named as: Grizzly, A6, and Bank514
in the dataset. Each µ-PMU device produces 12 streams of
120 Hz high-precision values with timestamps accurate to 100
ns (the limit of GPS). The 12 streams of data include bothmagnitude and phase angle for both voltage and current for
all three phases on a true distribution network [10].
B. Threat Model
This section describes three features characterizing the threat
model (e.g.,attack types, falsification margins, and falsification
distributions) that can be employed by organized adversaries.
Threat Model Scope: PMU being a comparatively new research area, real malicious data samples from PMUs are hard
to find. Therefore we generated the malicious samples byapplying the three aspects of adversarial strategy over the realdata. We have ensured that the falsification strategies used, do
not favor or suit our proposed defense mechanism.
In simple electrical terms, the term load is equivalent tothe current magnitude in each phase. Typically, in any phase,there could be two possibilities of load change. Either there
could be an increase or decrease in current, both creating an
imbalance in the power grid. An increase in the phase current
will cause the phase voltage to drop. If the current increases
too much, then the phase is shed or the load is switched toother phases. Imbalance can also occur if the current drops inany phase, making the system inefficient in terms of utilization.
This creates a motivation to falsify current measurements.
Attack Types: Attacks can be categorized in different types
based on how data is changed across multiple PMUs. Organized adversaries can falsify data from single or multiple
compromised PMU(s) simultaneously. Based on the objective
and intent of the adversary, any of the four streams (Voltage
Magnitude, Voltage Angle, Current Magnitude, Current Angle)of each phase can be falsified.
We assume the adversary falsify the ‘current magnitude’.
Let Iti (act) be the actual current magnitude of i-th PMU attime t, while Iti be it’s reported value. Under no attacks, theactual and reported value Iti = Iti (act), while under attacks
the reported value Iti can be biased by the following ways:
Deductive: In this case Iti from the i-th compromised PMU
at time t is changed to Iti (act) − Iδt , where Iδmin ≤ Iδt ≤Iδmax , for Iδmin > 0 is the false bias. Deductive attacks disrupt
the efficiency of the grid by reducing the power utilization.
Additive: An additive attack can be launched by a rival
utility to make the control center believe in a sudden increasein load which might lead to load shedding in that particularphase. Therefore, for additive falsification, the modified attack
sample is Iti = Iti (act) + Iδt from a compromised PMU.
Alternating Attack: The adversary alternates between additive and deductive falsification for equal time duration over thetime domain with the same average bias value of Iδt . In sucha case, the effect of additive and deductive falsification willcancel each other’s effect over a particular time period making
it hard over most device specific statistical anomaly detectors
to detect such attacks.
FDI Margin: We consider Iδavg as the average margin offalse data for each compromised PMU. The strategic value ofIδavg is selected by an adversary as some value that ensuressome minimum damage to the system. We keep this as an
uncontrolled variable to test detection sensitivity since there
could be various applications of PMU data. We consider thatthe attack is uniformly distributed Iδt ∈ [Iδmin , Iδmax ] that
does not change the resultant shape of the load distribution
drastically, making it a smarter and less obvious attack.
Attack Strategies: We consider three types of attack strategies: (a) Step attack: In this case the adversary modifies
all samples by Iδavg in the attack period. (b) Ramp attack:
Here adversary gradually increases the Iδt in each time slots
to reach Iδmax and then again gradually decreases Iδt [7].
(d) Mirroring: Here attacker captures Iti for some period andthen replaces the actual current measurements with the mirror
image of captured Iti .

IV. P ROPOSED F RAMEWORKThe proposed framework is divided into four steps: (1)Propose a derived process variable (active power from synchrophasor measurements) that will form the basis for the
anomaly detection process; (2) Design the invariant metric by
optimizing spatial and temporal granularities of the process
variable; (3) Design of a stateless and a stateful detection
thresholds that identify the normal region of invariants underno attacks from the training set, such that false alarms are
not drastically sacrificed for detection sensitivity improvement;(4) Determine the detection criteria parameters, based onlearning from the training and cross validation steps, andapply it on the testing set, such that the predictive accuracyof distinguishing between legitimate changes versus malicious
attacks is improved.
A. Choosing Process Variable for Anomaly Detection
Given the high velocity of the data, quick lightweight analytical tools are required for big data summarization to ensure
the security and integrity of the dataset. However, due to 12
streams of data per PMU, the variety of data is extremely large.
With multiple data streams per PMU, the anomaly monitoringof all these streams separately increases the computational costand latency in anomaly detection analytics.
Hence, we propose the active power calculated from synchrophasor data streams per PMU, as the process variable overwhich the data driven invariant is designed. The active power(P (j)) per phase from PMU measurements are calculatedusing the following standard power equations:
P (j) = V (j)I(j) cos θ(j)(1)
where j ∈ {1, 2, 3} denote the phases and V (j), I(j), θ(j) arevoltage magnitude, current magnitude, and angle difference
between voltage and current phases respectively, for the j-thphase. This reduces the complexity of the monitoring eachstream separately unlike existing works.
Another advantage is that any deliberate falsification of thevoltage or current (both in terms of magnitude and phase)will impact the active power, and hence we can potentiallydetect an attack on any of the data streams from PMUs.
Therefore, for our anomaly detection, we propose to use thephase wise monitoring of the active power P (j) as a starting
point. To clean the raw dataset [10] we have also applied 95%
Winsorization before proceeding with our model.
B. Achieving an Invariant for Anomaly Detection Metric
For real time anomaly detection in CPS, it has been established that a metric which is invariant under normal operating
conditions (without any attack) is ideal for attack detection.
However, unlike tightly controlled industrial CPS applications, the distribution level synchrophasor data is affected byrandomness and renewable power outputs and consumption
patterns, causing traditional statistical invariants to have highrandomness. As shown in Fig. 2a the arithmetic mean of thetime series is not stationary. Prior works such as [12] propose
the use of derived smoothing statistics of the arithmetic mean

0.93

200k

0.0012

250k
200k

0.92

0.91
0.905

100k

0.9
200

400

600

800

1000

1200

1400

0

0.8
0.6
0.4

Corr(Grizzly, Bank514)
Corr(A6, Bank514)
Corr(Grizzly, A6)

0.2
200

400

600

800

1000 1200 1400

0Corr(G,B)

Time(Minute Slot)

Time(Minute Slot)(a) AM.

Day 4
Day 5
Day 6

0.915

150k
0

Day 1
Day 2
Day 3

Correlation

HM/AM Ratio

100k

AM

0.925

Day 1 Day 4
Day 2 Day 5
Day 3 Day 6(b) HM/AM.

Corr(A,B)

where 0 ≤ Qr (T ) ≤ 1, as HMt ≤ AMt .

Intuitively,1) Optimizing the Spatial Granularity:a group of PMUs connected to the same feeder orserving proximate geographical areas should exhibit someinterdependence in the synchrophasor data streams. We use
the pairwise Pearson correlation coefficient to identify clusters
that show some level of positive correlation. The higher thedesired level of invariance, the higher is the required level ofpositive correlation. We calculate hourly Pearson’s correlation
among all pairs of PMUs in the training set to find groups

0.00110.00105
0.001
0

100

200

300

400

Frame Size(in Seconds)

Figure 3: PMU clustering and MAD over time window.
Upper Standard Limit

Training Set

.91
.908

Safe Upper Margin

Training Data

Lower Standard Limit

.001

.912

RUC Value

Ratio Value.914

We calculate HMt and AMt for slot t over a time window
T of length n slots. Then we calculate the average HMt to
AMt ratio, Qr (T ), at the end of each window as follows:
Pn
HMt
r
(3)
Q (T ) = Pt=1n
t=1 AMt

0.00115(a) Correlation among the PMUs. (b) MAD over time windows.

Figure 2: Illustrations of AM and HM/AM: Weekdays: Day
1,2,3,6; weekends: 4,5.
(such as ARMA, EWMA, CUSUM control charts) for timeseries anomaly detection. However, Fig. 2a shows that timeseries of PMUs active power fluctuates greatly over time
windows, making it difficult to distinguish legitimate changes
from a malicious one. Any moving average or smoothing
technique either loses sensitivity for a small margin of attacks(since the moving average does not reflect the changes beyond
already existing deviations or has large false alarms.
Let Pt = [Pt1 , ..., PtN ] denote the active power from N
PMUs at time slot t. We have taken second wise averageof active power for our analysis, thus t = 1 second. Recently, in [1], we have shown that the ratio of harmonicmean and arithmetic mean of positively correlated variables
exhibit invariance in their time series even when the individual
means show non-stationarity. Additionally, [1] showed thatthe data perturbations in any variable cause the ratio tolose its invariance. However, this stability is guaranteed forappropriately correlated variables only. Hence, our primary
goal is to investigate how to apply this on active power from
PMUs. To this aim, we need to find the appropriate spatial andtemporal granularity that maximizes the correlation between
active powers on a given phase across different PMUs, which
ensures invariance in the following metric:
Harmonic to Arithmetic Mean Ratio: Let the harmonicmean (HMt ) and arithmetic mean (AMt ) of Pt at time slot t
be defined as:
N
N
X
1X i
Pti )−1 and AMt =HMt = N (P .
(2)
N i=1 ti=1

Corr(G,A)

MAD Value

1
150k

0

-.001

Safe Lower Margin

0.906
150

200

250

300

Time(Minute Slot)

-.002
150

200

250

300

Time (Minute Slot)(a) Stateless Residual.

(b) Stateful Residual.

Figure 4: Stateless and Stateful Residuals for ǫ = 0.85.
having a maximum correlation. In the LBNL dataset, themean of hourly correlations between Grizzly, A6 is 0.98;
between Grizzly and Bank514 is 0.54; between A6 andBank514 is 0.55 as shown in Fig. 3a. It is evident from themean correlations that Grizzly and A6 are connected to thesame feeder and thus can be considered in a single cluster.
The average correlation identifies PMUs to be clustered under
one instance of the anomaly detection technique.
2) Optimizing Temporal Granularity: Now we focus onchoosing the appropriate time granularity over which the ratio
metric is calculated. The time granularity should be such thatthe invariance in the ratio metric is maximized (i.e., minimize
the measure of dispersion in the ratio statistic). Therefore, wesolve the following search problem:
T = argminM AD(Qr (T ∗ ))

(4)

T∗

where M AD(Qr (T ∗ )) is the median absolute deviation(MAD) of the resulting ratio time series with candidate time
granularity T ∗ ≤ 360 seconds. We choose T ∗ that minimizes
the MAD of the ratio time series (shown in Fig. 3b).
C. Stateless and Stateful Residual based Threshold Design
Intuitively, The anomaly detection needs to identify a proximate spatial region around the ratio time series that specifies
the behavior of the invariant under no attacks. Usually, athreshold is calculated by tracking the difference between theactual time series value and its smoothed value over time.
However, a simple threshold based approach, cannot decrease
both false alarms and missed detections simultaneously [12].
Hence, we put forward a two-tier approach with stateless andstateful residuals.
1) Stateless Residuals: The stateless residual is an instantaneous residual per time window T . Our method computes
the mean µr and median absolute deviation, mQ , from theprobability distribution of ratio values Qr (T ) for each PMU
cluster (shown in Fig. 4a).

Γh (T ) = Qr (T ) + ǫmQ .

(5)

Γl (T ) = Qr (T ) − ǫmQ .

(6)

To first derive, an instantaneous stateless residual ∇(T )which is the ’signed residual distance’ between the observed
ratio and the stateless residuals as:
 r
 Q (T ) − Γh (T ), if Qr (T ) > Γh (T );Qr (T ) − Γl (T ), if Qr (T ) < Γl (T );∇(T ) =
(7)0,otherwise.

The value of ∇(T ) could be positive (or negative) dependingon whether the ratio sample observed is above (or below) the
upper (or lower) safe margin Γh (T ) (or Γl (T )). Thus, ∇(T )is zero when the ratio observed is within [Γh (T ) , Γl (T )].
2) Stateful Residuals: Our framework now maintains thesum of residuals between the ratio value and the Γh (T ) andΓl (T ) over a sliding frame of past K time windows. We
denote this sum as RU C(T ). To calculate this metric. Now,
the framework calculates RU C(T ) over a sliding frame of past
K time windows as:
T
X
∇(j).
(8)
RU C(T ) =j=T −K

D. Optimizing Standard Limits of RU C(T )We need to calculate an upper and a lower threshold fromthe RUC values that prevent underfitting and overfitting andimproves detection performance in the test set. The procedure
for calculating the upper and lower thresholds is similar.
Algorithm 1, shows the method for τmax .
For this, we define a cost C, and penalty P , as the loss
functions. The cost and penalty function represents the loss
due to missed detection and false alarms respectively. One
key consideration in time series attack detection is to minimize

1

0.8
0.7
0.6

K = 10, w = 4
K = 10, w = 2
K = 5, w = 4
K = 5, w = 2

0.5
0.4
0

0.05

0.1

0.15

0.2

0.25

0.3

True Positive Rate (TPR)

Unlike our previous work [1], we propose the use of MedianAbsolute Deviation (MAD) as a scale parameter for designing
the stateless residual rather than the standard deviation (SD),because MAD is more robust to outliers. Thus, MAD canautomatically adjust the resultant safe margin under errors andoutliers in the training. The MAD is robust than SD since it
is based on a squared error from the mean, so a finite numberof outliers can influence SD easily compared to MAD, thus
reducing sensitivity to small attack strengths.
Stateless residual is parameterized as κ = ǫmQ whereǫ ∈ (0, 4], such that κ ∈ (0, 4mQ ] and mQ is the MAD.
Intuitively, larger κ values produce wider safe margins, thus
reducing false alarms but increasing misdetection and viceversa. Hence, a trade-off is necessary for selecting a thresholdthat will automatically generalize into lowering false alarms
while not sacrificing the detection sensitivity, which is takencare of by the stateful residual as shown in Fig. 4b.
Our framework calculates a parameterized ’stateless residual’ with two values; Γl (T ), and Γh (T ) around the observed
instantaneous ratio values Qr (T ), on every time window on
the training dataset, such that:

True Positive Rate (TPR)1
0.9

K=10, w=4

0.9

K=10, w=2

0.8

K=5, w=4
K=5, w=4

0.7
0.6
0.5

0

0.05

False Positive Rate (FPR)

0.1
0.15
0.2
0.25
False Positive Rate (FPR)

0.3

0.35

(a) ROC(CV) Additive Attack. (b) ROC(CV) Deductive Attack.

Figure 5: Parameter Selection from Cross Validation.
false alarms, since the actual probability of being under attack
is much lesser. Therefore, seemingly low false alarm rates,
do not necessarily indicate a good usable attack detector.
Therefore, we need to give more importance to the false
alarms. Hence, the loss due to false alarm (penalty P ) gets
more weight, compared to the loss due to missed detection(cost C) as is evident in Algorithm 1. In the end, we choosea threshold τmax (and τmin ) which minimizes the absolutedifference between total cost and penalty values for the positive
RUC samples (and negative RUC samples).
Algorithm 1 Calculate τmax
Input: list of τ : [τ ]Result: τmax
for T, [τ ] do
if RU C(T ) > 0 thenif RU C(T ) < τ then|τ −RU C(T )|Cmax :w
else
Pmax : w|RU C(T ) − τ |
end
end
end
τmax = argminτ |sum(Cmax ) − sum(Pmax )|The frame size K and weight w of C and P can be
determined optimally, by using a small cross validation set
with a few attack samples and test what values of K and w
are best. We plot the Receiver Operating Characteristic (ROC)
curve for the cross validation set (See Figs. 5a and 5b) for
various values of K and w, and choose that combination thatgives the steepest ROC curve.
E. Detection Criterion in Test Set
The main idea behind attack detection is that RUC in thetest set (RU C(T C )) should not deviate from the standard limit
obtained from the training set. We first calculate the statelessresiduals for each time window of the testing set T C suchthat Γh (T C ) = Qr (T h ) + κopt and Γl (T C ) = Qr (T h ) − κopt ,where κopt is the margin that resulted in the optimal standard
limit. The historical value of the ratio on that time window
Qr (T h ), where T c is the current time window and T h is thecorresponding time window in the training set, Γhigh (T c ) andΓlow (T c ) are the safe margins at T c of the test set.
From Γh (T C ) and Γl (T C ), we calculate the RU C(T C )using Eqn. 9. Then we check whether RU C(T C ) violates thestandard limit range identified during training set.
∈ [τmin , τmax ], No Anomaly;c
RU C(T ) :(9)∈/ [τmin , τmax ], Anomaly.

1

Attacked
No Attack

.001

0.91

Upper Standard Limit
Lower Standard Limit

0

0.908

.001

0.906
1500

-0.002
1500

True Positive Rate (TPR)

Safe Upper Margin
Safe Lower Margin

RUC Value

HM/AM Value

Attacked
No Attack

0.912

True Positive Rate (TPR)

1
.002

0.914

0.5
avg
avg

0

0

0.05

0.1

= 1 p.u.
= 1.5 p.u.

avg
avg

0.15

= 2 p.u.
= 2.5 p.u.

0.2

0.25

0.8
0.6
Additive
Deductive
Alternating

0.4
0.2
0

0

False Positive Rate (FPR)
1520

1540

1560

1580

1600

1520

Time (Minute Slot)

1540

1560

1580

1600

Time(Minute Slot)(a) Additive Attack: Tier 1.

(b) Additive Attack: Tier 2.

0.05

0.1

0.15

0.2

0.25

False Positive Rate (FPR)(a) ROC for Additive Attack.

(b) ROCs for δavg = 1 p.u.

Figure 8: Performance Analysis using ROCs.

Figure 6: Anomaly Detection for Additive Attack.
.003

.002

Attacked
No Attack.002

0
Attacked
No Attack-0.001

Upper Standard Limit
Lower Standard Limit

RUC Value

RUC Value

0.001

Upper Standard Limit
Lower Standard Limit.001
0-0.001-0.002-0.002
550

600

650

700

750

800

-0.003
550

600

650

700

750

800

850

Time(Minute Slot)

Time(Minute Slot)(a) Additive Ramp Attack: Tier 2.

(b) Mirroring Attack: Tier 2.

Figure 7: Anomaly Detection for Ramp and Mirroring Attack.
V. E XPERIMENTAL R ESULTS
Using the LBNL PMU dataset (see Sec. III), we conducted
extensive experiments for different falsification margins andattack strategies. For our experimental results, the first sevendays are the training set and the next two days of data is used
for cross validation and the remaining data are testing set. We
divide this section into two parts: (1) Snapshot Results thatshow how our method works under several attack strategies
and types (2) Performance Evaluation that shows the sensitivity versus the false alarm across varying attack margins.
Snapshot Results: We randomly selected a period from thetest set and introduced an attack on the current magnitude from
A6 PMU with δavg 1 p.u (which is approximately 0.16 amps).
Tier 1 detection scheme to infer the presence of an attack isshown in Fig. 6a and subsequently tier 2 is applied to confirm
the presence of the attack as shown in Fig. 6b. The detectionof the ramp and mirroring attacks are shown in Fig. 7a andFig. 7b. For both of these types, we have randomly selected aperiod of 15 minutes and introduced the respective attacks.
Performance Evaluation: For performance evaluation, we
generate the ROC curve that characterizes the trade-off between the probability of attack detection vs. the probability offalse alarm. we vary the δavg from 1 p.u to 2.5 p.u (≈ 0.4
amps) using a step strategy to show the ROC for the additive
attacks in Fig. 8a. A comparative analysis of ROCs of additive,
deductive, and alternating attacks for an attack margin of 1 p.u.
is shown in Fig. 8b. A report on accuracy (A), false positive(FP), and false negative (FN) for different attack margins incase of deductive and alternating attacks is given in Table I.
Table I: Experimental Results.
Attack On
Curr. Mag.
Curr. Mag.
Curr. Mag.
Curr. Mag.

Attack Type
Deductive
Deductive
Alternating
Alternating

Margin(p.u.)
1
1.5
1
1.5

A(%)
99
100
91
99

FP(%)
1
1
1
1

FN(%)
1
0
9
1

VI. C ONCLUSIONSIn this work, we presented a real time anomaly based attack
detection for current magnitude falsification in PMU data
streams. We showed that harmonic to arithmetic mean ratios
can be used an effective invariant that is stable without attacks
but show changes during attacks. We showed that even if theattacker has knowledge about the underlying time series weare still able to identify anomaly with a low false alarm rate
in real time. Also, unlike many existing bad data detection
methodologies, it does not require the topology of the grid
network. In future, we will extend the idea to capturing voltage
and phase angle falsification, and validate effectiveness against
bigger PMU networks.
ACKNOWLEDGMENT
This work is supported by NSF grants SaTC-2030611,
OAC-2017289, CNS-1818942, and SaTC-2030624.
R EFERENCES[1] S. Bhattacharjee, S. K. Das, ”Detection and Forensics against Stealthy
Data Falsification in Smart Metering Infrastructure,” to appear, 2020.
[2] L.M. Branscomb, R.D. Klausner, ”Making the nation safer: the roleof science and technology in countering terrorism” National ResearchCouncil, 2002.
[3] Defense Use Case, ”Analysis of the cyber attack on the Ukrainian power
grid,” Electricity Information Sharing and Analysis Center (E-ISAC), vol.
388, 2016.
[4] T.M. Chen, ”Stuxnet, the real start of cyber warfare?[Editor’s Note]”
IEEE Network, vol. 24, no. 6, pp. 2-3, 2010.
[5] J. Jiang, X. Zhao, S. Wallace, E. Cotilla-Sanchez, and R. Bass., ”Mining
PMU Data Streams to Improve Electric Power System Resilience,” ACM
BDCAT, pp. 95-102, 2017.
[6] T. Morris, S. Pan, J. Lewis, J. Moorhead, B. Reaves, N. Younan, R.
King,M. Freund, and V. Madani., ”Cybersecurity testing of substation
phasor measurement units and phasor data concentrators” 7th Annual
ACM CSIIRW, pp. 12-14, 2011.
[7] S. Pal, B. Sikdar, and J.H. Chow., ”Classification and detection of PMU
data manipulation attacks using transmission line parameters,” IEEE
Transactions on Smart Grid, vol. 9, no. 5, pp. 5057-5066, 2017.
[8] D.P. Shepard, T.E. Humphreys, and A.A. Fansler., ”Evaluation of thevulnerability of phasor measurement units to GPS spoofing attacks,”
International Journal of Critical Infrastructure Protection, vol. 5, no.
3-4, pp. 146-153, 2012.
[9] V.K. Singh and M. Govindarasu., ”Decision Tree Based Anomaly
Detection for Remedial Action Scheme in Smart Grid using PMU Data,”
IEEE Power & Energy Society General Meeting, pp. 1-5, 2018.
[10] E. Stewart, A. Liao, and C. Roberts., ”Open µpmu: A real world reference distribution micro-phasor measurement unit data set for research
and application development,” LBNL Tech. Rep. 1006408, 2016.
[11] NDT Team., ”Synchrophasor Monitoring for Distribution Systems: Technical Foundations and Applications,” North American Synchrophasor
Initiative, Tech. Rep, 2018.
[12] D.I. Urbina, J.A. Giraldo, A.A. Cardenas, N.O. Tippenhauer, J. Valente,M. Faisal, J. Ruths, R. Candell, and H. Sandberg., ”Limiting theimpact of stealthy attacks on industrial control systems,” ACM CCS, pp.
1092-1105, 2016.

[13] M. Wu and L. Xie., ”Online detection of false data injection attacks tosynchrophasor measurements: A data-driven approach,” HICSS, 2017.
[14] Z. Zhang, S. Gong, A.D. Dimitrovski, and H. Li., ”Time synchronization
attack in smart grid: Impact and analysis,” IEEE Transactions on Smart
Grid, vol. 4, no. 1, pp. 87-98, 2013.