Context information-based cyber security defense of protection system

With the development of a substation automation system, it is now feasible for the intelligent electronic devices-based protection system to collect its measurements from electronic instrument transformers through a communication network such as an Ethernet-based local-area network. The application of a wide-area broadband network in power utilities introduces underlying danger for protection systems to maloperate when receiving fake data packages from an intruder. This paper proposes identifying a vicious fault by using context information, such as voltage and current, of the same substation. When the protection system detects a fault based on measurements transmitted through a network, it collects all measurements of the substation and feeds these data to a probabilistic neural network. Thereafter, the fault caused by fake data that differs from the known fault pattern can be identified and blocked.