Episodic Detection of Spoofed Data In Synchrophasor Measurement Streams Phasor Measurement Units (PMUs) provide highquality state information about the electrical grid in nearreal time. However, as utilities become more reliant on these measurements, the devices themselves as well as the communication network that supports them will likely become a more prominent attack surface for cyber threats. In this paper, we demonstrate a system designed to find anomalous PMU dataxe2x80x93specifically data that is intended to provide false signal readings (spoofed data) over a period of time. Our system uses support vector machines to distinguish between xe2x80x9cnormalxe2x80x9d system operation and xe2x80x9cspoofedxe2x80x9d operation. The work presented here makes three main contributions. Specifically, we demonstrate: (1) a SVMbased classifier that has reasonable longevity (i.e., once trained, the classifier remains valid for a reasonable length of time); (2) a distributed version of our classifier that improves the efficiency and scalability; and (3) the classifiers above can be used to detect spoofs at different levels of fidelity which can have a dramatic effect on their suitability in a realworld operating environment.

Whitelisting Cyber Attack Detection according to Estimated Operational States for CPS These days, cyber attacks against cyberphysical systems (CPS) such as power plants are constantly growing, and therefore the countermeasures are essential. Whitelisting cyber attack detection, that detects anomalous activity as deviation from normal network communication, is especially attracting attention as one of the countermeasures because the traffic patterns are predictable in CPS. However, attackers can execute illegal operations within the normal network communication defined as the whitelisting detection rules because such operations tend to cause unstable control depending on operational states. In this work, we propose a new whitelisting cyber attack detection method that estimates the operational state of CPS and monitors the CPS network with the whitelisting detection rules according to the estimated state. The proposed method can define the more limited normal network communication to generate the whitelisting detection rules in each operational state. We experimented and evaluated the method on a plant simulator, and confirmed the effectiveness of the method: state estimation with support vector machine and attack detection with divided whitelisting detection rules.