Patent Description:
Wind power is considered one of the cleanest, most environmentally friendly energy sources presently available, and wind turbines have gained increased attention in this regard. A modern wind turbine typically includes a tower, a generator, a gearbox, a nacelle, and one or more rotor blades. The rotor blades capture kinetic energy of wind using known airfoil principles. For example, rotor blades typically have the cross-sectional profile of an airfoil such that, during operation, air flows over the blade producing a pressure difference between the sides. Consequently, a lift force, which is directed from a pressure side towards a suction side, acts on the blade. The lift force generates torque on the main rotor shaft, which is geared to a generator for producing electricity.

A plurality of wind turbines are commonly used in conjunction with one another to generate electricity and are commonly referred to as a "wind farm. " Each of the individual wind turbines may be controlled via a turbine controller. Similarly, the overall wind farm may be controlled via a farm-level controller. Such controllers may also be connected to a network, either locally or via the Internet, such that the wind farm and the individual turbine controllers can be controlled online and in real-time. As the wind power business continues to increase in popularity, however, so too does the risk of cyberattack on the control systems thereof.

Moreover, wind turbines are dynamic systems operated under unknown and stochastic operation conditions (i.e., turbulent wind field). With a limited number of sensors available, developing a cyberattack detection and isolation system that can effectively and efficiently detect cyberattacks as well as pinpoint where the attack occurs becomes extremely challenging. For example, using a single detection model for an entire turbine unit results in a detection model that is overwhelmingly complex. As such, properly training such a complex model to cover a wide range of stochastic operation conditions is practically impossible (assuming the training samples are abundantly available).

<CIT> describes system and method for anomaly and cyber-threat detection in a wind turbine; <CIT> describes implementing network security measures in response to a detected cyber attack; <CIT> describes system and method for fusing multiple analytics of a wind turbine for improved efficiency.

Accordingly, the present disclosure is directed to improved systems and methods for detecting and isolating a cyberattack on a control system of a wind turbine that address the aforementioned issues.

In one aspect, the present disclosure is directed to a method for detecting a cyberattack on a control system of a wind turbine. The method includes providing a plurality of classification models of the control system. The method also includes receiving, via each of the plurality of classification models, a time series of operating data from one or more monitoring nodes of the wind turbine. The method further includes extracting, via the plurality of classification models, a plurality of features using the time series of operating data. Each of the plurality of features, for example, is a mathematical characterization of the time series of operating data associated with the one or more monitoring nodes. Moreover, the method includes generating an output from each of the plurality of classification models. In addition, the method includes determining, using a decision fusion module, a probability of the cyberattack occurring on the control system based on a combination of each of the outputs. Thus, the method includes implementing a control action when the probability exceeds a probability threshold.

In an embodiment, the time series of operating data may include any one
or more of pitch angle set point, measured pitch angle, performance proxy, wind acceleration, tower movement, nacelle movement, one or more pitch feedbacks, torque, wind speed, power output, generator speed, rotor speed, azimuth angle, one or more loading conditions, frequency, voltage, current, or functions thereof.

In another embodiment, the plurality of features may include one or more estimated parameters characterizing at least one of a turbulent wind field or turbulence level and length scales. In such embodiments, the turbulent wind field may include at least one of a rotor-plane-averaged wind speed in 3D, rotor-plane-averaged wind direction in 3D, turbulent intensity in 3D, vertical and horizontal wind shear, and wind veer.

In an embodiment, the mathematical characterization may include, for example, a maximum, minimum, mean, standard deviation, variance, settling time, Fast Fourier Transform ("FFT") spectral components, linear and non-linear principal components, independent components, sparse coding, deep representation learning, or any other suitable mathematical characterization of the time series of operating data.

In further embodiments, each of the outputs may include, as an example, a scalar score representing the probability of the cyberattack occurring on the control system. Thus, in such embodiments, determining the probability of the cyberattack occurring on the control system based on the combination of each of the outputs may include identifying any of the scalar scores exceeding a score threshold and determining the probability of the cyberattack occurring on the control system based on the combination of each of the scalar scores.

In another embodiment, determining the probability of the cyberattack occurring on the control system based on the combination of each of the outputs may include integrating a plausibility of an estimated operating condition.

In additional embodiments, the method may include monitoring different components of the wind turbine or determining different cyberattacks occurring on the control system of the wind turbine or combinations thereof via each of the plurality of classification models.

In several embodiments, each of the plurality of classification models may include a machine learning algorithm. For example, in an embodiment, each of the machine learning algorithms may include a decision stump, an extreme learning machine, a convolutional neural network, or similar, or combinations thereof.

In particular embodiments, each of the plurality of classification models may be different types of models that receive the time series of operating data. In addition, or in the alternative, one or more of the plurality of classification models may include one or more interdependencies with each other, such as, for example, a shared node of the monitoring nodes, a shared feature of the plurality of features, or the scalar score of one or more of the plurality of classification models being used as a feature in another one of the plurality of classification models.

In an embodiment, the method may include training the plurality of classification models using data sets from the monitoring nodes of the wind turbine and/or training a coupled ensemble neural network.

In further embodiments, extracting, via the plurality of classification models, the plurality of features using the time series of operating data may include generating an overall feature vector from the plurality of features, the overall feature vector comprising interactive features of the plurality of features from two or more monitoring nodes, reducing a dimension of the overall feature vector using a dimensionality reduction technique, and calculating the plurality of features over a sliding window of the time series of operating data.

In yet another embodiment, the method may include determining a length and duration of the sliding window using domain knowledge, data inspection, and/or batch processing.

In certain embodiments, the method may include optimizing a type and number of the plurality of features for each of the one or more monitoring nodes using at least one of domain-knowledge, feature engineering, or receiver operating characteristic (ROC) statistics.

In further embodiments, the decision fusion module may include decision fusion module comprises at least one of a logic operator or a weighted average of the outputs or a machine learning algorithm that maps multiple decisions to a single output.

In another aspect, the present disclosure is directed to a system for detecting a cyberattack on a control system of a wind turbine. The system includes a controller having a plurality of classification models. The controller is configured to perform a plurality of operations, including but not limited to receiving, via each of the plurality of classification models, a time series of operating data from one or more monitoring nodes of the wind turbine, extracting, via the plurality of classification models, a plurality of features using the time series of operating data, each of the plurality of features being a mathematical characterization of the time series of operating data associated with the one or more monitoring nodes, generating an output from each of the plurality of classification models, determining, using a decision fusion module, a probability of the cyberattack occurring on the control system based on a combination of each of the outputs, and implementing a control action when the probability exceeds a probability threshold. It should be understood that the control system may include any one or more of the additional features described herein.

The system for detecting a cyberattack on a control system of a wind turbine of the present disclosure is particularly configured to perform operations as explained herein in relation to the method for detecting a cyberattack on a control system of a wind turbine.

Generally, the present disclosure is directed to a system and method for detecting cyberattack and subsystem level isolation in wind turbines using an ensemble of anomaly detectors (also referred to herein as classification models). In particular, each anomaly detector may be a classification model that is trained using features extracted from a polarity of wind turbine monitoring nodes (e.g., sensors, actuators, controller parameters, etc.). Furthermore, the ensemble includes different machine learning-based classification methods, such as extreme learning machines and deep convolutional neural networks. In addition to subsystem level isolation, the ensemble of anomaly detectors is capable of providing a classification for attack types as well.

More particularly, in certain embodiments, ensemble learning may be a machine learning paradigm, which leverages a collection of diverse base learners (models) to achieve better prediction performance than that could be achieved by any individual base learner. For example, the system of the present disclosure includes an ensemble of classification models that each use a subset of wind turbine monitoring nodes. The monitoring nodes represent certain signals and/or measurements that are accessible directly from the wind turbine installment (e.g., measured generator speed or control output). Thus, in an embodiment, the system may include at least eight machine learning classification models trained on data sets from the monitoring nodes to either monitor specific components of the wind turbine, detect cyberattacks or both. Furthermore, each of the classification models can extract their own set of features from the node signals for high detection accuracy and representation of information diversity. The output of each classification model may be, for example, a scalar score representing the probability of a cyberattack. Observed score magnitudes above certain predetermined thresholds are configured to indicate a fault and/or an attack. The scores from all of the classification models can also be assimilated to determine whether an abnormality or cyberattack has been identified. Thus, the present disclosure provides for determining whether an aberration has taken place at a time when the abnormal signals exceed a certain threshold.

The present disclosure may also include a system and method for cyberattack detection on systems with unknown and stochastic operation. More specifically, in certain embodiments, an estimator can be used to estimate one or more operating conditions of the system, followed by a statistical analysis and database block to analyze the plausibility of the estimated operating condition(s). The plausibility analysis result can then be combined with the cyberattack detection algorithm(s) described herein, which use feature extraction and classification, to determine if the system is being attacked.

Thus, the present disclosure provides many advantages not present in the prior art. For example, the systems and methods of the present disclosure provide for anomaly detection (e.g., attacks or faults) in wind turbines and provide subsystem attack/fault isolation as well as type classification. More particularly, the present disclosure enables modeling of a complex system with multiple subsystems or components to not only achieve a higher detection performance, but also facilitate attack localization and classification.

Referring now to the drawings, <FIG> illustrates an exemplary embodiment of a wind farm <NUM> containing a plurality of wind turbines <NUM> according to aspects of the present disclosure. The wind turbines <NUM> may be arranged in any suitable fashion. By way of example, the wind turbines <NUM> may be arranged in an array of rows and columns, in a single row, or in a random arrangement. Further, <FIG> illustrates an example layout of one embodiment of the wind farm <NUM>. Typically, wind turbine arrangement in a wind farm is determined based on numerous optimization algorithms such that AEP is maximized for corresponding site wind climate. It should be understood that any wind turbine arrangement may be implemented, such as on uneven land, without departing from the scope of the present disclosure.

In addition, it should be understood that the wind turbines <NUM> of the wind farm <NUM> may have any suitable configuration, such as for example, as shown in <FIG>. As shown, the wind turbine <NUM> includes a tower <NUM> extending from a support surface, a nacelle <NUM> mounted atop the tower <NUM>, and a rotor <NUM> coupled to the nacelle <NUM>. The rotor includes a rotatable hub <NUM> having a plurality of rotor blades <NUM> mounted thereon, which is, in turn, connected to a main rotor shaft that is coupled to the generator housed within the nacelle <NUM> (not shown). Thus, the generator produces electrical power from the rotational energy generated by the rotor <NUM>. It should be appreciated that the wind turbine <NUM> of <FIG> is provided for illustrative purposes only. Thus, one of ordinary skill in the art should understand that the invention is not limited to any particular type of wind turbine configuration.

As shown generally in the figures, each wind turbine <NUM> of the wind farm <NUM> may also include a turbine controller <NUM> communicatively coupled to a farm-level controller <NUM>. Moreover, in one embodiment, the farm-level controller <NUM> may be coupled to the turbine controllers <NUM> through a network <NUM> to facilitate communication between the various wind farm components. The wind turbines <NUM> may also include one or more sensors <NUM>, <NUM>, <NUM> configured to monitor various operating, wind, and/or loading conditions of the wind turbine <NUM>. For instance, the one or more sensors may include blade sensors for monitoring the rotor blades <NUM>; generator sensors for monitoring generator loads, torque, speed, acceleration and/or the power output of the generator; wind sensors <NUM> for monitoring the one or more wind conditions; and/or shaft sensors for measuring loads of the rotor shaft and/or the rotational speed of the rotor shaft. Additionally, the wind turbine <NUM> may include one or more tower sensors for measuring the loads transmitted through the tower <NUM> and/or the acceleration of the tower <NUM>. In various embodiments, the sensors may be any one of or combination of the following: accelerometers, pressure sensors, angle of attack sensors, vibration sensors, Miniature Inertial Measurement Units (MIMUs), camera systems, fiber optic systems, anemometers, wind vanes, Sonic Detection and Ranging (SODAR) sensors, infra lasers, Light Detecting and Ranging (LIDAR) sensors, radiometers, pitot tubes, rawinsondes, other optical sensors, and/or any other suitable sensors.

Referring now to <FIG>, there is illustrated a block diagram of one embodiment of suitable components that may be included within the farm-level controller <NUM>, the turbine controller(s) <NUM>, and/or other suitable controller according to the present disclosure. As shown, the controller(s) <NUM>, <NUM> may include one or more processor(s) <NUM> and associated memory device(s) <NUM> configured to perform a variety of computer-implemented functions (e.g., performing the methods, steps, calculations and the like and storing relevant data as disclosed herein). Additionally, the controller(s) <NUM>, <NUM> may also include a communications module <NUM> to facilitate communications between the controller(s) <NUM>, <NUM> and the various components of the wind turbine <NUM>. Further, the communications module <NUM> may include a sensor interface <NUM> (e.g., one or more analog-to-digital converters) to permit signals transmitted from one or more sensors <NUM>, <NUM>, <NUM> (such as the sensors described herein) to be converted into signals that can be understood and processed by the processors <NUM>. It should be appreciated that the sensors <NUM>, <NUM>, <NUM> may be communicatively coupled to the communications module <NUM> using any suitable means. For example, as shown, the sensors <NUM>, <NUM>, <NUM> are coupled to the sensor interface <NUM> via a wired connection. However, in other embodiments, the sensors <NUM>, <NUM>, <NUM> may be coupled to the sensor interface <NUM> via a wireless connection, such as by using any suitable wireless communications protocol known in the art.

As used herein, the term "processor" refers not only to integrated circuits referred to in the art as being included in a computer, but also refers to a controller, a microcontroller, a microcomputer, a programmable logic controller (PLC), an application specific integrated circuit, and other programmable circuits. Additionally, the memory device(s) <NUM> may generally include memory element(s) including, but not limited to, computer readable medium (e.g., random access memory (RAM)), computer readable non-volatile medium (e.g., a flash memory), a floppy disk, a compact disc-read only memory (CD-ROM), a magneto-optical disk (MOD), a digital versatile disc (DVD) and/or other suitable memory elements. Such memory device(s) <NUM> may generally be configured to store suitable computer-readable instructions that, when implemented by the processor(s) <NUM>, configure the controller(s) <NUM>, <NUM> to perform various functions as described herein.

Moreover, the network <NUM> that couples the farm-level controller <NUM>, the turbine controllers <NUM>, and/or the wind sensors <NUM> in the wind farm <NUM> may include any known communication network such as a wired or wireless network, optical networks, and the like. In addition, the network <NUM> may be connected in any known topology, such as a ring, a bus, or hub, and may have any known contention resolution protocol without departing from the art. Thus, the network <NUM> is configured to provide data communication between the turbine controller(s) <NUM> and the farm-level controller <NUM> in near real time and/or online. Moreover, in an embodiment, the network <NUM> may include the Internet and/or cloud computing. Accordingly, the controller(s) <NUM>, <NUM> may be susceptible to various cyberattacks.

Thus, referring now to <FIG> and <FIG>, a method <NUM> and system <NUM> for detecting a cyberattack on a control system of a wind turbine, such as one of the wind turbines <NUM> in the wind farm <NUM>, are illustrated. More specifically, <FIG> illustrates a flow diagram of a method <NUM> for detecting a cyberattack on a control system of a wind turbine according to the present disclosure, whereas <FIG> illustrates a schematic diagram of a system <NUM> for detecting a cyberattack on a control system of a wind turbine according to the present disclosure. In general, as shown in <FIG>, the method <NUM> is described herein as implemented for cyberattack detection for the wind turbine(s) <NUM> and/or the wind farm <NUM> described above. However, it should be appreciated that the disclosed method <NUM> may be used to detect cyberattacks for any other wind turbine(s) and/or wind farm having any suitable configuration. Further, it should be understood that the controller configured to implement the methods described herein may be the farm-level controller <NUM>, one or more of the turbine controllers <NUM>, and/or any other suitable controller located within the wind farm <NUM> or remote from the wind farm <NUM>. In addition, although <FIG> depicts steps performed in a particular order for purposes of illustration and discussion, the methods described herein are not limited to any particular order or arrangement. One skilled in the art, using the disclosures provided herein, will appreciate that various steps of the methods can be omitted, rearranged, combined and/or adapted in various ways.

As shown at (<NUM>), the method <NUM> includes providing a plurality of classification models <NUM> of the control system. In several embodiments, for example, each of the plurality of classification models <NUM> may include a machine learning algorithm. For example, in an embodiment, each of the machine learning algorithms may include a decision stump, an extreme learning machine, a convolutional neural network, or similar, or combinations thereof. As used herein, a decision stump generally refers to a machine learning algorithm that makes a prediction based on the value of just a single input feature. An extreme learning machine generally refers to a feedforward neural networks for classification, regression, clustering, sparse approximation, compression and feature learning with a single layer or multiple layers of hidden nodes, where the parameters of the hidden nodes (not just the weights connecting inputs to the hidden nodes) need not be tuned. A convolutional neural network generally refers to a class of deep neural networks, most commonly applied to analyzing visual imagery.

In further embodiments, the classification models <NUM> may include any suitable modeling algorithm or process, such as stepwise linear regression. Generally, stepwise linear regression adds or removes features one at a time in an attempt to get the best regression model without over fitting. Further, stepwise regression typically has two variants, including forward and backward regression. For example, forward stepwise regression is a step-by-step process of building a model by successive addition of predictor variables. At each step, models with and without a potential predictor variable are compared, and the larger model is accepted only if it leads to a significantly better fit to the data. Alternatively, backward stepwise regression starts with a model with all predictors and removes terms that are not statistically significant in terms of modeling a response variable.

The classification models <NUM> may also include an absolute shrinkage and selection operator (LASSO) algorithm or a M5 Prime (M5P) algorithm. Generally, a LASSO algorithm minimizes the residual sum of squares subject to a constraint that the sum of the absolute value of the coefficients is smaller than a constant. A M5 Prime (M5P) algorithm generally refers to a tree-based regression algorithm that is effective in many domains. For example, whereas stepwise linear regression produces a single global linear model for the data, tree based regression algorithms perform logical tests on features to form a tree structure. Generally, the M5P algorithm utilizes a linear regression model at each node of the tree, providing more specialized models. Still other machine learning methods may be utilized, such as Gaussian Process Models, Random Forest Models, Support Vector Machines, and/or a micro-service.

In addition, in particular embodiments, the number of the classification models <NUM> may be designed for monitoring different components of the wind turbine(s) <NUM>, detecting different types of cyberattacks, or a combination of two. Accordingly, each of the classification models <NUM> may have a physical connection with a different component of the wind turbine <NUM> to enable cyberattack isolation of a particular component. Further, as will be described herein, the method <NUM> may include integrating the outputs of the individual classification models <NUM>.

For example, as shown in <FIG>, a schematic diagram of one embodiment of the system <NUM> for detecting a cyberattack on a control system of a wind turbine according to the present disclosure is illustrated. More specifically, as shown in <FIG>, the system <NUM> may include a control system <NUM> (such as one of the turbine controllers <NUM> or the farm-level controller <NUM>) that includes a plurality of monitoring nodes <NUM> and a plurality of the classification models <NUM>. In such embodiments, the monitoring nodes <NUM> used in each ensemble (i.e., each subsystem) can be selected using knowledge-based or data-driven based techniques. Moreover, as shown, the system <NUM> may include any suitable number of classification models <NUM>. For example, the illustrated system <NUM> includes eight individual models. In further embodiments, the system <NUM> may include any suitable number of classification models, including more than eight models or less than eight models.

Thus, referring back to <FIG>, as shown at (<NUM>), the method <NUM> includes receiving, via each of the plurality of classification models <NUM>, a time series of operating data <NUM> from one or more of the monitoring nodes <NUM> of the wind turbine <NUM>. In an embodiment, for example, the time series of operating data <NUM> may include any one or more of pitch angle set point, measured pitch angle, performance proxy, wind acceleration, tower movement, nacelle movement, one or more pitch feedbacks, torque, wind speed, power output, generator speed, rotor speed, azimuth angle, one or more loading conditions, frequency, voltage, current, or functions thereof.

In further embodiments, each of the plurality of classification models <NUM> may have different features and/or different types of models, which provides the adequate diversity required for achieving higher detection accuracy and robustness of the ensemble model. In addition, or in the alternative, one or more of the plurality of classification models <NUM> may include one or more interdependencies with each other, such as, for example, a shared node of the monitoring nodes, a shared feature of the plurality of features, or the scalar score of one or more of the plurality of classification models being used as a feature in another one of the plurality of classification models <NUM>.

In yet another embodiment, the method <NUM> may also include training the plurality of classification models <NUM> using data sets from the monitoring nodes <NUM> of the wind turbine(s) <NUM> and/or training a coupled ensemble neural network. For example, in an embodiment, the interactions among the models can be trained using techniques such as coupled ensembles of deep neural networks. A deep coupled ensemble neural network may be learned using either supervised or semi-supervised methods depending on the availability of data.

For example, in an embodiment, the control system <NUM> may be configured to continuously train the classification models <NUM> using a human annotator. As used herein, annotation (e.g., annotated analytics) in machine learning generally refers to a process of labelling data in a manner that can be recognized by machines or computers. Furthermore, such annotation can be completed manually by humans as human annotators generally better interpret subjectivity, intent, and ambiguity within the data. Thus, machines can learn from the annotated data by recognizing the human annotations over time. In some cases, annotation can be learned by artificial intelligence and/or other algorithms, such as semi-supervised learning or clustering, as well as any other suitable accurate labeling process.

Accordingly, referring still to <FIG>, as shown at (<NUM>), the method <NUM> includes extracting, via the plurality of classification models <NUM>, a plurality of features <NUM> using the time series of operating data <NUM>. For example, in an embodiment, as shown in <FIG>, the system <NUM> includes a plurality of feature extraction modules <NUM> that receive the time series of operating data <NUM> from a collection of monitoring nodes <NUM> (e.g., sensors, actuators, controller nodes, etc.), and extracts features <NUM> from the time series data for each monitoring node <NUM>. For example, in an embodiment, each of the feature extraction modules <NUM> is configured to extract one or more features using the time series data from either a single monitoring node <NUM> or a collection of the monitoring nodes <NUM>. As used herein, the term "feature" generally refers to, for example, mathematical characterizations or representations of the time series of operating data. Such mathematical characterizations may include, for example, a maximum, minimum, mean, standard deviation, variance, settling time, Fast Fourier Transform ("FFT") spectral components, linear and non-linear principal components, independent components, sparse coding, deep representation learning, or any other suitable mathematical characterization of the time series of operating data. Moreover, the term "feature" may also refer to a mathematical characterization or representation of physics, engineering knowledge, and/or control logic, e.g., based on one or more of the monitoring nodes <NUM>.

In further embodiments, the system <NUM> may also include a plurality of detection modeling modules <NUM> configured to receive the extracted features <NUM>. Such detection modeling modules <NUM> can thus assist with choosing a proper feature subset from an overall feature vector from the plurality of features <NUM>. In such embodiments, the overall feature vector may contain interactive features <NUM> from two or more monitoring nodes <NUM>, e.g., cross-correlation between two nodes. As such, the method <NUM> may also include normalizing the features <NUM> and/or reducing a dimension of the overall feature vector using a dimensionality reduction technique, such as principal component analysis. Furthermore, in an embodiment, the method <NUM> may include calculating the plurality of features <NUM> over a sliding window of the time series of operating data <NUM>. In yet another embodiment, the method <NUM> may include determining a length and/or duration of the sliding window using domain knowledge, data inspection, and/or batch processing.

In further embodiments, the method <NUM> may also include optimizing a type and/or number of the plurality of features <NUM> for each of the one or more monitoring nodes <NUM> using at least one of domain-knowledge, feature engineering, or receiver operating characteristic (ROC) statistics.

Details of one embodiment of an example system are summarized in Table <NUM> below, including the number of classification models <NUM>, the extracted features <NUM>, and the type of detection model.

Where DS refers to decision stump, ELM refers to extreme learning machine, and CNN refers to convolutional neural network.

Referring still to <FIG>, as shown at (<NUM>), the method <NUM> includes generating an output <NUM> from each of the plurality of classification models <NUM>. In certain embodiments, for example, as shown in <FIG>, each of the outputs <NUM> may include a scalar score representing the probability of the cyberattack occurring on the control system <NUM>. Thus, as shown at (<NUM>), the method <NUM> includes determining, using a decision fusion module <NUM>, a probability of the cyberattack occurring on the control system <NUM> based on a combination of each of the outputs <NUM>. For example, in particular embodiments, the decision fusion module <NUM> is configured to determine the probability of the cyberattack by identifying any of the scalar scores exceeding a score threshold and determining the probability of the cyberattack occurring on the control system <NUM> based on the combination of each of the scalar scores.

In such embodiments, the decision fusion module <NUM> described herein may include a machine learning algorithm (e.g., a machine-learning based model trained using labeled data) or a weighted average of the outputs (e.g., a weighted average of the scalar scores compared to the score threshold. Accordingly, the decision fusion module <NUM>, similar to the classification models <NUM>, may also be trained. In further embodiments, decision fusion module <NUM> may also include a logical operation, a soft combination of the probabilistic score, or another trained classification model. In other words, the control system <NUM> may include any suitable supervised machine learning algorithm that can apply what has been learned in the past to new data using labeled data to predict future decisions. Starting from the model build, the learning algorithm produces an inferred function to make predictions about the output values. As such, the control system <NUM> is able to provide targets for any new input after sufficient training. The learning algorithm can also compare its output with the correct, intended output and find errors in order to modify the model accordingly.

Referring back to <FIG>, as shown at (<NUM>), the method <NUM> further includes implementing a control action when the probability of a cyberattack exceeds a probability threshold. For example, as shown in <FIG>, the output <NUM> of the decision fusion module is configured to indicate whether operation is normal or whether a cyberattack has occurred.

Accordingly, in such embodiments, for example, the control action may include generating an alarm. It should be understood that the control action as described herein may further encompass any suitable command or constraint by the control system <NUM> For example, in several embodiments, the control action may include temporarily de-rating or up-rating the wind turbine <NUM>.

Up-rating or de-rating the wind turbine <NUM> may include speed up-rating or de-rating, torque up-rating or de-rating or a combination of both. Further, as mentioned, the wind turbine <NUM> may be uprated or de-rated by pitching one or more of the rotor blades <NUM> about its pitch axis. The wind turbine <NUM> may also be temporarily up-rated or de-rated by yawing the nacelle <NUM> to change the angle of the nacelle <NUM> relative to the direction of the wind. In further embodiments, the controller(s) <NUM>, <NUM> may be configured to actuate one or more mechanical brake(s) in order to reduce the rotational speed of the rotor blades <NUM>. In still further embodiments, the controller(s) <NUM>, <NUM> may be configured to perform any appropriate control action known in the art. Further, the controller(s) <NUM>, <NUM> may implement a combination of two or more control actions.

Referring now to <FIG>, a schematic diagram of another embodiment of the system <NUM> for detecting a cyberattack on a control system of a wind turbine according to the present disclosure illustrated. In particular, as shown, the cyberattack detection architecture includes the classification model(s) <NUM> having the feature extraction module <NUM> and the detection modeling module <NUM> as described herein, as well as additional function blocks (e.g., such as an estimator module <NUM> and a statistical analysis module <NUM> and database) that can be integrated with the decision fusion module <NUM>.

Thus, in such embodiments, and as shown in <FIG>, the estimator module <NUM> is configured to estimate unknown and/or stochastic operating conditions of the system <NUM>. For example, for the wind turbine(s) <NUM>, the estimator module <NUM> may estimate certain key parameters to characterize the turbulent wind field (e.g., rotor plane averaged wind speed in 3D, rotor plane averaged wind direction in 3D, turbulent intensity in 3D, vertical and horizontal wind shear, wind veer, etc.). Furthermore, the estimator module <NUM> may use spectral estimation methods to estimate stochastic wind parameters such as turbulence level and turbulence length scales. As such, in certain embodiments, the estimator module <NUM> is configured to fit the parameters into a standard stochastic wind model, such as a Kaimal spectral model, a von Karman spectrum distribution, or a data-driven model using techniques such as Autoregressive Moving Average (ARMA) or Autoregressive Integrated Moving Average (ARIMA) modeling. In further embodiments, the estimator module <NUM> can be derived from first principle in a model-based manner, or can be derived from a data-driven approach using regression or machine learning. Thus, as shown, an output <NUM> of the estimator module <NUM> can be fed into both the feature extraction module <NUM> and/or the statistical analysis module <NUM> and database.

Still referring to <FIG>, the statistical analysis module <NUM> and database is configured to analyze the plausibility of the output <NUM> (i.e., the estimated operating condition) from the estimator module <NUM>. Accordingly, in such embodiments, the statistical analysis module <NUM> and database can be implemented by analyzing the amplitude, frequency, and phase of the estimated operating condition using time-frequency analysis technique, by comparing the estimated operating condition with the historical data from the database, or by using a probabilistic model with prior distribution to calculate the posterior distribution. As such, the statistical analysis module <NUM> and database assists with cyberattack detection with unknown and estimated operating conditions by generating the plausibility of the operating condition(s) (represented as output <NUM>). For example, in certain instances, several critical attacks on the wind turbine(s) <NUM> cannot be detected by analyzing the consistency of the measured signals using the system <NUM> of <FIG> because it is possible to construct a wind field that is consistent with all measurements, which makes the attacked data appear normal. Thus, the statistical analysis module <NUM> and database does not treat the constructed wind field as granted, but rather questions the plausibility of the constructed wind field based on multiple factors, including historical probability distribution or prior domain knowledge of the field.

Another benefit of using the statistical analysis module <NUM> and database is to allow quick adaption when the cyberattack detection module is deployed to a large number of heterogeneous assets. For example, the wind turbine(s) <NUM> in a single wind farm can experience different external wind conditions due to the difference of their relative location. Without the estimator module <NUM> and the statistical analysis module <NUM> and database, the system <NUM> needs to train the classification model(s) <NUM> for each wind turbine <NUM> individually. However, by using the proposed architecture, each wind turbine <NUM> can compare the estimated wind condition with the historical data collected individually, which allows turbine-wise adaption of the cyberattack detection algorithm.

Thus, in such embodiments, as shown in <FIG>, the decision fusion module <NUM> is configured to blend the plausibility of the operating condition(s) (e.g., output <NUM>) with the output(s) <NUM> from the classification models <NUM> to determine if the system <NUM> is being attacked.

Claim 1:
A method for detecting a cyberattack on a control system of a wind turbine, the method comprising:
providing (<NUM>) a plurality of classification models of the control system;
receiving (<NUM>), via each of the plurality of classification models, a time series of operating data from one or more monitoring nodes of the wind turbine;
extracting (<NUM>), via the plurality of classification models, a plurality of features using the time series of operating data, each of the plurality of features being a mathematical characterization of the time series of operating data;
generating (<NUM>) an output from each of the plurality of classification models;
determining (<NUM>), using a decision fusion module, a probability of the cyberattack occurring on the control system based on a combination of each of the outputs; and,
implementing (<NUM>) a control action when the probability exceeds a probability threshold.