If you don't remember your password, you can reset it by entering your email address and clicking the Reset Password button. You will then receive an email that contains a secure link for resetting your password
If the address matches a valid account an email will be sent to __email__ with instructions for resetting your password
Department of Electrical Power Engineering and Mechatronics, Tallinn University of Technology, Tallinn, EstoniaCenter for Energy Science and Technology, Skolkovo Institute of Science and Technology, Moscow, Russia
ADCIT is used for detection, classification and identification of anomalies in power system state estimation.
•
Outputs of state estimators are used as inputs for machine learning algorithms.
•
ADCIT does not require retraining of the machine learning algorithm in the presence of network topology changes.
•
ADCIT can help the power system operator to design proper countermeasures in case of an anomaly occurrence.
Abstract
The Anomaly Detection, Classification and Identification Tool (ADCIT) is an open source Matlab and Python code used for detection, classification and identification of anomalies in power system state estimation. Outputs of weighted least squares (WLS) and extended Kalman filter (EKF) state estimators, developed in Matlab, are used as inputs for machine learning algorithms developed in Python. The ADCIT can address hard anomaly cases; for example, it can detect and classify the case when load is abruptly changed at multiple nodes simultaneously, or when false data injection attack targets multiple states at the same time. Additionally, the ADCIT does not require retraining of the machine learning algorithm in the presence of network topology changes. Application of the ADCIT within power grid energy management system can help system operator to design proper countermeasures in case of an anomaly occurrence.
Power system state estimation (SE) plays an important role in energy management systems. Its task is to provide accurate estimates of voltage magnitudes and phase angles for all nodes in the system [
]. SE can be subjected to many types of anomalies, among which bad data (BD), sudden load changes (SLC) and false data injection attacks (FDIA) are common. In order to take proper countermeasures by the system operator, anomalies must be reliably detected, classified and identified [
]. To this end, the Anomaly Detection, Classification and Identification Tool (ADCIT) is developed. Detection of anomalies takes place in the first ADCIT stage through application of the Matlab source code. In the second ADCIT stage, classification of anomalies and identification of anomalies’ origin is done in Python.
]. However, it is difficult to detect either SLC or FDIA by applying -test within weighted least squares (WLS) estimator. The ADCIT combines estimated states of WLS and extended Kalman filter (EKF) to set up an anomaly detection index (ADI) capable of detecting both SLC and FDIA; however, ADI cannot discriminate between SLC and FDIA. To classify (or, discriminate) SLC and FDIA correctly, various supervised machine learning (ML) algorithms have been implemented. Moreover, the case when load is abruptly changed at multiple nodes simultaneously (named “multi-bus SLC”), or FDIA is targeting multiple states at the same time (named “multi-state FDIA”) are for the first time considered and ADCIT is capable to correctly discriminate between multi-bus SLC and multi-state FDIA. Furthermore, the features utilized for training the ML algorithm(s) are associated only with the network nodes. This increases the robustness of the algorithms by eliminating the need to retrain the ML algorithm in case of network topology changes. Inside the ADCIT, different ML algorithms are available and they are user-defined. Finally, different types of anomalies can be successfully analyzed by the ADCIT.
2. ADCIT algorithm
The ADCIT algorithm has been implemented in Matlab and Python. Fig. 1 demonstrates the general scheme of the ADCIT algorithm. The details regarding each code are presented below.
To provide the labeled data for the training of the ML algorithms power system simulations are conducted within Matlab environment. Firstly, raw measurements are generated using the procedure described below. Next, raw measurements are processed by two types of state estimators, namely WLS and EKF, to get the estimated (and, in case of EKF, predicted) electrical quantities. IEEE 14 bus test system [
R. Christie, Power Systems Test Case Archive. 14 Bus Power Flow Test Case, 1993, University of Washington, Department of Electrical Engineering, [Online] Available at https://labs.ece.uw.edu/pstca/pf14/pg_tca14bus.htm.
MATPOWER, an open-source Matlab extension for solving steady-state power system optimization problems, has been utilized to execute consecutive optimal power flows (OPFs) over the time [
]. Considering that the load at each consumption node is given, the OPF provides nodal voltage magnitudes, active/reactive power flows in branches and active/reactive power injections at generator nodes. These values are used as the true values of measurements. A noise term, having Gaussian distribution with zero mean and 0.01 standard deviation, is added to the true measurements to get the raw measurements.
To simulate a BD case, corresponding raw measurements are corrupted with a random error which does not fall under the predefined Gaussian distribution. For simulating a SLC, a pre-specified amount of load is curtailed at the desired time instant during the execution of the consecutive OPFs. In the case of FDIA, the raw measurements are modified according to the attack vector. To simulate multi-bus SLC or multi-state FDIA, the user can change the setting of parameters SLC_bus or FDIA_state from a scalar value to a vector. This change has to be made in the main m-file. For instance, SLC_bus [5 10 12] means that the SLC is happening at the nodes 5, 10 and 12 simultaneously.
WLS and EKF based state estimations are carried out under normal operating conditions (i.e., quasi steady state) and abnormal operating conditions (BD, SLC or FDIA). Apart from the estimated states, other outputs, such as predicted states, normalized residuals and normalized innovations, are obtained. To detect BD, measurement residuals obtained via WLS state estimation are used to carry out -test. In case there is no BD, the algorithm will check for SLC or FDIA using ADI [
]. In case ADI value is equal or higher than a specific threshold, anomaly is detected; otherwise, system is considered to be in the normal operation mode.
It is to be noted that the moment when an anomaly occurs and vanishes can be specified within the code. Additionally, it is also possible to change the test system or network topology; however, it requires further modification of the parameter settings in MATPOWER source file and several m-files.
2.2 Python: Classification and identification
Python environment is used for input data pre-processing and application of the ML algorithms for anomaly classification and identification. For the sake of comparison, four supervised ML algorithms, namely Random Forest (RF), Extreme Gradient Boosting (XGB), Logistic Regression (LR) and K-Near Neighbors (KNN) are applied [
As mentioned before, to eliminate the need to retrain the ML algorithms when the network topology changes, the features associated with the power lines are excluded and only the features associated with the nodes are utilized. The features associated with the nodes are: (a) Nodal measurements and normalized measurement innovations of voltage magnitudes and active/reactive power injections; (b) Estimates and predictions of voltage magnitudes, phase angles and active/reactive power injections.
Maximum relevance – minimum redundancy (MRMR) algorithm has been applied for the feature selection [
]. The parallelization function has been included in the MRMR script to utilize multiple cores of the CPU and run tasks in parallel. Accordingly, the most relevant features can be found fast and without additional computational complexity.
For executing the ML algorithms, standard models from the scikit-learn library have been applied [
L. Buitinck, G. Louppe, M. Blondel, F. Pedregosa, A. Mueller, O. Grisel, V. Niculae, P. Prettenhofer, A. Gramfort, J. Grobler, R. Layton, J. VanderPlas, A. Joly, B. Holt, G. Varoquaux, API design for machine learning software: experiences from the scikit-learn project, in: ECML PKDD Workshop: Languages for Data Mining and Machine Learning, 2013, pp. 108–122.
]. All models are trained by tuning appropriate hyperparameters. Hyperparameters are tuned using sequential optimization with gradient boosting as a surrogate probability model of the objective function [
]; the scikit-optimize library is used for this purpose.
3. Illustrative example
An example of the results obtained by ADCIT is demonstrated in Fig. 2. If holds, then there is a high probability of the existence of a BD. Here, stands for -test’s objective function; corresponds to a value from the distribution table with the probability and () degrees of freedom; and is the number of observed measurements and number of estimated states, respectively.
If , SLC or FDIA presence is detected. Here, stands for maximum ADI value, and represents the detection threshold that has to be selected to clearly discriminate between normal operation and anomalies [
Fig. 2 shows detection indices when the system is affected by FDIA. FDIA tends to increase the voltage magnitude at bus for 0.1 p.u., starting from and persists until the end of the simulation.
It is obvious that the largest ADI test is highly capable of detecting anomaly presence, while anomaly bypass the -test. Yet, this test is not able to classify the occurred anomaly according to its type. Therefore, ML algorithms have been utilized for the classification of the anomalies. Table 1 summarizes the performances of the ML algorithms in terms of calcification accuracy and training time, for the classification of SLC and FDIA, i.e., to discriminate between SLC and FDIA. [
]. Due to the fact that some of the features might be redundant or less relevant for the training of the ML algorithms, MRMR has been applied to select the most relevant features. In this example, the number of features selected by MRMR is compared to the number of features without MRMR (WO MRMR) which is . This has helped to reduce the training time of the ML algorithms. Although the accuracy of LR and KNN algorithm slightly decreases, in the case of RF and XGB algorithm the accuracy remains the same.
Accurate anomaly detection, classification, and identification are of great importance for power system state estimation. The impacts of the ADCIT are twofold. Firstly, it can be applied as an educational tool. It provides an opportunity for the researchers to observe the adverse effects of the anomalies on the state estimates, and to analyze how the ADCIT enables anomaly detection, classification, and identification in order to avoid these effects [
]. In another word, the researchers can modify/extend the ADCIT to implement their own ideas. This means that the ADCIT can be used as a platform for the future research work.
Yet another impact of the tool is its capability for industrial implementation. Without the requirement of any additional hardware installation, the ADCIT can be integrated within the energy management systems in power system control rooms [
]. Besides, the specification of the anomaly type (i.e., anomaly classification) by the ADCIT will assist the system operator for proper decision making.
Creating a graphical user interface, considering other types of anomalies such as network parameter errors, and designing suitable countermeasures against anomalies, can be considered as future directions for the development of ADCIT.
Declaration of Competing Interest
The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.
Acknowledgments
Work of S. Asefi, M. Mitrovic, E. Gryazina and V. Terzija was supported by Skoltech and The Ministry of Education and Science of Russian Federation, Grant Agreement No 075-10-2021-067, Grant identification code 000000S707521QJX0002. Work of D. Ćetenović and V. Levi was supported by the Engineering and Physical Sciences Research Council (EPSRC) of UK (Grant No. EP/S00078X/2 and Grant No. EP/T021969/1), and the Ministry of Education, Science and Technological Development of the Republic of Serbia
(Grant No. 451-03-68/2022-14/200132 with University of Kragujevac - Faculty of Technical Sciences Čačak).
R. Christie, Power Systems Test Case Archive. 14 Bus Power Flow Test Case, 1993, University of Washington, Department of Electrical Engineering, [Online] Available at https://labs.ece.uw.edu/pstca/pf14/pg_tca14bus.htm.
L. Buitinck, G. Louppe, M. Blondel, F. Pedregosa, A. Mueller, O. Grisel, V. Niculae, P. Prettenhofer, A. Gramfort, J. Grobler, R. Layton, J. VanderPlas, A. Joly, B. Holt, G. Varoquaux, API design for machine learning software: experiences from the scikit-learn project, in: ECML PKDD Workshop: Languages for Data Mining and Machine Learning, 2013, pp. 108–122.
00002-7&id=gr1.jpg){kind=link}
00002-7&id=gr2.jpg){kind=link}