A machine learning-based cyberattack detection and prevention system for protective relays in high voltage substations

The usage of the Internet of Things (IoT) conception in the industrial sector along with applications is referred to as the Industrial Internet of Things (IIoT). Various applications have been subsumed in the IIoT. Nevertheless, cybercriminals mostly target these systems. Thus, here, a novel methodology of Cyber Attack Detection (CAD) system has been proposed in IIoT to overcome the aforementioned issue. UNSW-NB2015 and DS2OS are the two IIoT datasets utilized in this work. Initially, in both datasets, the missing values are replaced; subsequently, the feature extraction is performed. Next, by utilizing Poisson Distribution-based Naked Mole Rat Optimization Algorithm (PD-NMROA), the significant features are selected as of both datasets. After that, by employing MaHalanobis distance-based K-Means (MaH-KMeans) algorithm, the features extracted as of the datasets are normalized along with clustered. Eventually, to classify the data, the clustered features are inputted to the TanSwish - Restricted Boltzmann Dense Machines (TS-RBDMs). The experiential outcomes displayed that the proposed methodology obtained higher efficacy in contrast to the prevailing systems.

Cyber attack detection technology plays a vital role today, since cyber attacks have been causing great harm and loss to organizations and individuals. Feature selection is a necessary step for many cyber-attack detection systems, because it can reduce training costs, improve detection performance, and make the detection system lightweight. Many techniques related to feature selection for cyber attack detection have been proposed, and each technique has advantages and disadvantages. Determining which technology should be selected is a challenging problem for many researchers and system developers, and although there have been several survey papers on feature selection techniques in the field of cyber security, most of them try to be all-encompassing and are too general, making it difficult for readers to grasp the concrete and comprehensive image of the methods. In this paper, we survey the filter-based feature selection technique in detail and comprehensively for the first time. The filter-based technique is one popular kind of feature selection technique and is widely used in both research and application. In addition to general descriptions of this kind of method, we also explain in detail search algorithms and relevance measures, which are two necessary technical elements commonly used in the filter-based technique.

This paper outlines the most recent developments regarding the magnetic field distribution analysis inside very high voltage substations. The study was performed in order to develop and validate a powerful computation tool able to determine and predict the magnetic field value inside any point of the substation and to check whether the exposure limits exceeds the admissible values imposed by the legislation. The study case proposed in the paper is taken from the Romanian national power grid but the conclusions outlined can be directly extended to substations belonging to other national power grids. In the first part of the paper the principles and methods proposed by the authors for the magnetic field computation in the vicinity of the power devices composing a high voltage substation are outlined. The validation of the computation module implemented was done by comparisons with detailed experimental measurements results performed inside a new rehabilitated 400 kV substation. The evaluation of the results outlines a good agreement between the computed and measured magnetic field values inside the analyzed substation. This fact motivates the usage of the computation module developed in the design of the future high voltage substations in the light of fulfilling the actual regulations regarding the human exposure to power electric and magnetic fields. In the second part of the paper results of the field values inside the studied substation are presented. The final conclusions end the paper.

This work presents the application of an expanded version of a software tool, formed using powerful AutoCAD software and the programming language Visual Basic, which enables the estimation and visualisation of a 3D lightning protection zone for a high voltage substation (HVS). Various models, methods and protective devices used for protected zone evaluation are discussed. Special attention is dedicated to ground wires as an efficient protective device in forming lighting protection for an HVS. A sensitivity analysis is conducted for a presented 220/110/10 kV HVS protected zone construction depending on the type and dimensions of the protective devices, impulse current magnitude and the various methods. The educational aspects of the application of this software tool are very important for both undergraduate and PhD students studying High Voltage Technique and Computer-Aided Design/Engineering (CAD/CAE) in Power Systems. During the past two academic years, the software application has received favourable comments from students.

With the increasing investment in the construction of power facilities and the use of higher voltage level, the noise generated by high voltage substation has become an unavoidable issue. The noise of the high-voltage substation is a mixture which is mixed by different noise sources. The mixed noise must be separated to several independent noise signals firstly for researching. An algorithm combined with the Wavelet Transform and the Sparse Component Analysis was presented in this paper which can separate the single channel mixed noise signal of high-voltage substation. The single channel blind source separation can be changed to the underdetermined blind source separation by setting two augmented signals which are the low-frequency part and the high-frequency part separated from the original noise signal by the Wavelet Transform. Then the signals of different noise sources can be separated by the Sparse Component Analysis. It is proved by the simulation and experiment in 330kV high-voltage substation that the algorithm can solve not only the underdetermined blind source separation, but also the single-channel blind source separation effectively.

This study generalizes the modeling details to be used in modeling the high voltage substation and performing the analysis on the impact of lightning surge on surge arrester placement in high voltage substation using the PSCAD/EMTDC software. Modeling parameters and the substation layout design are based and adapted from 132 kV substation in Johor Baharu, Malaysia, courtesy of the Tenaga Nasional Berhad (TNB). The model is based on single phase line model as it was suggested by the IEEE to be adequate to represent the substation in transient analysis simulation. The outcome of this paper would be the results of prediction of the breakdown current and effect of surge arrester placement in terms of voltage level measured at particular points in substation.

Measurement of transient potentials in substation yards on control circuits, CTs, CPTs, 115 vac receptacles, howlers, yard telephones, heaters, flood lights and cable lead sheaths during disconnect switch arcing require more stringent instrumentation techniques than comparable measurements made in the control house. Methods and equipment have been devised to trigger oscilloscopes independent of recorded transient and reduce measuring circuit interference voltages.

Due to the rapid growth of cyber-security challenges via sophisticated attacks such as data injection attacks, replay attacks, etc., cyber-attack detection and avoidance system has become a significant area of research in Cyber-Physical Systems (CPSs). It is possible for different attacks to cause system failures, malfunctions. In the future, CPSs may require a cyber-defense system for improving its security. The different deep learning algorithms based on cyber-attack detection techniques have been considered for the detection and mitigation of different types of cyber-attacks. In this paper, the newly suggested deep learning algorithms for cyber-attack detection are studied and a hybrid deep learning model is proposed. The proposed Hybrid Convolutional Multilayer Perceptron for Cyber Physical Systems (HCMP-CPS) model is based on Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM), Multi-Layer Perceptron (MLP). The HCMP-CPS model helps to detect and classify attacks more accurately than the conventional models.

This paper describes a situation awareness framework, Frankenstack, that is the result of a multi-faceted endeavor to enhance the expertise of cybersecurity specialists by providing them with real-time feedback during cybersecurity exercises and verifying the performance and applicability of monitoring tools during those exercises. Frankenstack has been recently redeveloped to improve data collection and processing functions as well as cyberattack detection capability. This extensive R&D effort has combined various system and network security monitoring tools into a single cyberattack detection and exercise feedback framework.Although Frankenstack was specifically developed for the NATO CCD COE’s Crossed Swords exercise, the architecture provides a clear point of reference for others who are building such monitoring frameworks. Thus, the paper contains many technical descriptions to reduce the gap between theoretical research and practitioners seeking advice on how to implement such complex systems.

This thesis: Implementing the Eco Design Methology MEErP in Voltage and Current Measuring Transformers operating in High Voltage networks evaluates the applicability of the 2009/125/ EU Directive for the Eco Design on the Measuring Transformers Operating in Electricity Transmission Systems. The study of measuring transformers using spreadsheets (Excel) with the EU eco-design reference methodology (MEErP 2011), tries to quantify their environmental impact and consequently the environmental impact of the power transmission system using this equipment, in all stages of its life. This study was conducted using data from measuring transformers operating in the Hellenic Electricity Transmission System operated by the Independent Power Transmission Operator of Greece (IPTO). This thesis is one of the first ones trying to evaluate the environmental impact of measuring transformers operating in high voltage networks. It reports using the EU reference methodology MEErP and directives and principles of the Eco Design in a life cycle analysis (LCA) perspective. The implementation of MEErP provides the environmental impacts of the measuring transformers and reports the findings. Also this process can show the importance of the Eco Design approach in high voltage equipment operating in High Voltage Energy Transmission systems, and goes beyond the already regulated Power Transformers with the (EU) Regulation No 548/2014 which was amended by Regulation (EU) 2019/1783. This thesis discusses the function, technology and components of instrument transformers applied in high voltage substations. Ageing phenomena and failure modes of instrument transformers are discussed, followed by techniques to detect and mitigate instrument transformer ageing and stresses to improve the lifetime of instrument transformers. In this thesis, details life cycle analysis (LCA) of current and voltage HV measuring transformers of main manufactures are included. The data collected from the operating measuring transformers in 150kV and 400kV transmission network of Greece. Furthermore, quick description is reported on power transmission system and the Ten-year Network Development Plan of the IPTO National Power Transmission System in Greece.

The globalization of information exchange and the widespread introduction of information technologies in all spheres of society's life created the problem of protecting information processed in information systems from challenges and threats in the cybernetic space. The presence of important information in the functioning of the systems and critical national infrastructures objects enables its usage by the negatively-minded elements and groupings for the implementation of unlawful actions in the cyberspace by violating the integrity, availability, and confidentiality of information, and inflicting damage on information resources and information systems. In this case, the possibility of using information technologies in the cybernetic space in the interests of carrying out military-political and power confrontation, terrorism, and hacking cyber attacks are of particular concern. Today, intrusion detection and attack systems are usually software or hardware-software solutions that automate the process of monitoring events occurring in the information system or network, and independently analyze these events in search of security issues signs. An analysis of modern approaches to the development of such systems shows that it is the signature analysis of network traffic provides effective results in the development of protection modules of cyber systems. In addition, for the reliable protection of information systems, it is not only necessary to develop separate mechanisms of protection, but also to implement a systematic approach that includes a set of interrelated measures. The purpose of the article is to develop a system for recognizing cyber threats based on signature analysis, which would reduce the time of an attack detection of a cyber defense system while the number and complexity of cyber attacks are increasing

The superconducting fault current limiter (SFCL) for a nominal voltage of 220 kV and a rated current of 1200 A was developed by SuperOx company to be applied in high voltage substation in Moscow, Russia. The device is a three-phase dead-tank apparatus and is equipped with a closed-cycle cryocooling system. Liquid nitrogen serves simultaneously as a cooling and an insulating media. The device makes use of about 25 km of 12 mm wide high-performance 2G HTS wire with uniform properties along the length. High-voltage tests of the device were performed at Korea Electrotechnology Research Institute (KERI) in accordance with the IEEE C37.302-2015 test guide and Russian national standards for high voltage electrical equipment. The installation of the SFCL at substation in parallel with the existing air core reactors was completed in 2019. Since then, the device is in a daily operation. Over this period, SFCL has fully confirmed its design specifications including transmitting over 80 million kWh to customers and experiencing three fault current events.

Partial discharge (PD) is considered as an important marker of insulation deterioration of high voltage (HV) apparatus. Therefore, PD monitoring is crucial for ensuring the sound and safe operation of high-voltage (HV) substations. In this work, an optical fiber-based, sensitive, and simple acoustic PD sensor module is proposed, which introduces a fiber-to-fiber coupling arrangement placed at the internal focal region of a suitably modelled exponential horn-shaped waveguide. The exponential horn concentrates the PD-generated ultrasonic pressure waves, thereby amplifying the acoustic emission and resulting in a larger impact at the focal point. These impacts cause small transverse misalignments between the transmitting and receiving optical fibers of the fiber-to-fiber coupling arrangement, which alter the coupling efficiency and result in measurable changes in the intensity of the coupled light. This intensity-modulation scheme eliminates the need for sophisticated optical components, such as fiber Bragg gratings or tunable lasers, resulting in a cost-effective and compact system suitable for installation in substations for monitoring PD events. The horn-assisted sensor offers a better signal-to-noise ratio and a broader detection bandwidth, which would otherwise be challenging. Furthermore, the performance of the proposed sensor is compared with the standard IEC 60270-based electrical detection system in the laboratory, which confirms the comparable detection capability of the proposed method. The system demonstrates reliable performance even in the presence of significant electromagnetic interference, making it suitable for identifying early-stage PD activity across air, oil, and solid insulation. The findings suggest that the introduced horn-guided fiber-optic sensor holds great potential for real-time partial discharge monitoring and evaluating the condition of high-voltage substation assets.

A wide-area measurement system (WAMS) consists of advanced measurementtechnology,thelatestcommunicationnetworkinfrastructure,andintegratedoperationalframework. The supervisory control and data acquisition (SCADA) infrastructure forenergy-management system (EMS) has been widely used in power systems for a longtime. Some of the functionalities of an EMS are system state monitoring, tie-line biascontrol,andeconomicdispatch[1].However,inrecentyears,variousdeficienciesoftheexisting SCADA-based EMS (such as quasi-steady-state calculation, non-synchronizeddataacquisition,andrelativelylowdatatransmissionrate)havebeenpointedout.Thesedefects make it impossible to sample the global state of a power system in real time.As more and more wide-area blackouts are reported, it is clear that acquiring real-timeor wide-area state information would be needed in the future. The state informationin terms of phasors of voltages and currents from a distributed wide area in real timeis therefore critical for avoiding large-area disturbances by effecting wide-area controlbased on wide-area measurements.The main enabler of WAMS is phasor measurement unit (PMU) technology. Withthe innovation of PMU, the problem of measuring the phasor quantities simultaneouslyfromawideareaofdistributedsubstations,alsocalled‘synchrophasor’,hasbeensolved.At present, the PMU technology is one of the essential enablers for WAMS. It utilizesthe availability of high-precision synchronized clock sources – extracted from globalpositioning system (GPS) receivers and samples the instantaneous analogue – quanti-ties of voltage and current magnitudes and phase angles. Many utilities are installingPMUs at very high voltage substations, but the trend is that eventually PMUs will beused to monitor all high-voltage transmission lines. There are debates as to whether thewide-area or long-distance communications that communicate phasor data, or controlaction messages, should only be done via proprietary networks, or the existing Inter-net infrastructure with quality-of-service (QoS) differentiated delivery could be used.These questions require further simulation studies as well as financial and policy deci-sions which are not considered in this chapter. We concentrate mostly on evaluatingthe network architecture, the specific network medium and technology, the appropriate

Construction and operating staff working in and around high voltage substations and high voltage transmission systems may be exposed to unacceptable touch voltage hazards. Examples of tasks where staff may be exposed include: civil excavation in a live substation requiring removal of the insulating crushed rock layer, cable jointing, pipeline construction and repair. The removal of the crushed rock layer exposes workers to an increased chance of fibrillation under earth fault conditions. Wet or damp soil increases this risk further. Safety gumboots are made of rubber with plastic soles which could reduce this shock risk. This paper examines the insulation resistance and breakdown voltage for a range of new and used safety gumboots as an effective control measure in the shock circuit. The information from this testing is then used to build a quantified probabilistic shock risk model for resistance and withstand voltage of safety gumboots. This model is then used in a case study of a substation worker.