# Advancements and Research Trends in Microgrids Cybersecurity
## 6 Physics-Based Anomaly Detection  
Cyber-attacks against industrial systems aim to modify the physical behavior of the usual system process. In cyber-physical systems, the physical evolution of the system state has to follow immutable laws of nature. For this reason, some papers propose to add a further line of defense in ICS, represented by algorithms able to rapidly notice abnormal physical behaviors based on measures extracted from the industrial process. For example, the physical properties of the process can be used to create models that, in turn, may be exploited to check if information coming from sensors is consistent with the physical laws and the expected physical behavior of the system and if the sent control commands correspond to a real need or if they derive from an artificial modification of the measure. Applications include not only smart microgrids but also water control systems, power grids, chemical process control, and medical devices, among many others. Monitoring the \"physics\" of cyber-physical systems to detect attacks is a growing area of research. Reference [37] presents a review of physics-based anomaly detection schemes based on a unified taxonomy. These system can be categorized under different viewpoints. Two possible categories are: algorithms based on pre-defined models and algorithms based on Machine Learning (ML). State estimation models for power systems, which exploit the known equations of power transmissions, belong to the first category. However, for some complex systems, such as DES, to write a closed-form equation that takes into account all the measured parameters can be difficult. In these cases, ML can help develop anomaly detection algorithms, even if the great disproportion between available data of normal and abnormal behavior typical in cyber-physical systems can limit the application of ML-based schemes. Peculiar anomaly detection techniques are used to address this issue [38]. Physics-based Anomaly Detection Systems find many applications in the smart microgrid environment. After the development a consensus-based distributed voltage control architecture of isolated DC microgrids, an analytical consistency-based anomaly detection mechanism based on variables associated with the proposed algorithm is presented in Reference [39]. Reference [40] proposes an IDS built on the combination of network data, together with power system and control information. Reference [41] shows a contextual anomaly detection method based on an artificial neural network and its use in the detection of malicious voltage control actions in the low voltage distribution grid. Reference [42] presents a high-dimensional data-driven cyber-physical attack detection and identification based on electric waveform data measured by waveform sensors in the distribution power networks. Reference [43] describes an anomaly detection algorithm to reveal attacks on PhotoVoltaic (PV) systems, such as PV disconnect, power curtailment, Volt-var attack, and reverse power flow in a portion of the distribution grid with a sufficient percentage of DER penetration. This approach exploits semi-supervised ML algorithms, such as Neural network autoencoder, One Class Support Vector Machine (SVM), Isolation Forest, Random Forest with synthetic corruption, Principal Component Analysis (PCA) with convex hulls, and Inverse-PCA techniques. An approach based on a fully-connected neural network autoencoder to detect cyber-attacks within a PV system is proposed in Reference [44]. A deep learning scheme composed of long and short term memory-stacked autoencoders and convolutional neural networks followed by a softmax activation layer is used in Reference [45] for fault detection in a wind turbine. Physics-based anomaly detection systems represent an interesting field of research, in particular for DERs.