Abstract

Abstract The emergence of high-speed networks in electric power systems creates a tight interaction of cyber infrastructure with the physical infrastructure and makes the power system susceptible to cyber penetration and attacks. To address this problem, this paper proposes an innovative approach to develop a specification-based intrusion detection framework that leverages available information provided by components in a contemporary power system. A Bayesian network is used to graphically encode the causal relations among the available information to create patterns with temporal state transitions, which are used as rules in the proposed intrusion detection framework. This allows the proposed framework to detect cyber attacks and classify different substation scenarios. A case study is provided for the non-pilot directional over current relay protection scheme for a modified 2-bus 2-generator system taken from a section of the IEEE 9-bus 3-generator system. Nine power system scenarios were developed and implemented as part of the case study. Each scenario was implemented on a test bed and all scenarios were correctly classified by the IDS built using the proposed methodology.