# US 10,372,569 B2 · Methods and system for detecting false data injection attacks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,372,569 B2 - Document ID: US10372569B2 - Status: Granted - Kind: B2 - Application number: 15/218,822 - Filed: 2016-07-25 - Published: 2018-01-25 - Granted: 2019-08-06 - Earliest claimed: 2016-07-25 - Assignees: General Electric Company - Applicants: General Electric Company - Inventors: William James Premerlani; Chaitanya Ashok Baone; Yan Pan - Web page: https://patentgrep.com/patent/US10372569B2 ## CPC - G06F 11/2221: {to test input/output devices or peripheral units} - G05B 23/0227: {Qualitative history assessment, whereby the type of data acted upon, e.g. waveforms, images or patterns, is not relevant, e.g. rule based assessment; if-then decisions} - G06F 11/2215: {to test error correction or detection circuits} - G06F 11/327: {Alarm or error message display} - G06F 11/3672: {Test management} - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/554: {involving event detection and direct action} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L 63/1416: {Event detection, e.g. attack signature detection} - Y04S 40/18: Network protocols supporting networked applications, e.g. including control of end-device applications over a network - Y04S 40/20: Information technology specific aspects, e.g. CAD, simulation, modelling, system security - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - Y04S: SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS ## Abstract A system for detecting false data injection attacks includes one or more sensors configured to each monitor a component and generate signals representing measurement data associated with the component. The system also includes a fault detection computer device configured to: receive the signals representing measurement data from the one or more sensors, receive a fault indication of a fault associated with the component, generate a profile for the component based on the measurement data, and determine an accuracy of the fault indication based upon the generated profile. ## Claims ### Claim 1 A system for detecting false data injection attacks, said system comprising: one or more sensors configured to monitor a component and generate signals representing measurement data associated with the component, wherein said one or more sensors comprise a first sensor and a second sensor: and a fault detection computer device comprising a processor and a memory coupled to said processor, said fault detection computer device in communication with said one or more sensors, said fault detection computer device configured to: receive the signals representing measurement data from the one or more sensors; receive signals from said first sensor and said second sensor, wherein said first sensor is proximate to the component and said second sensor is a distance from said first sensor: receive a fault indication of a fault associated with the component; generate a component profile for the component based on the measurement data; determine a first profile based on the signals from said first sensor: determine a second profile based on the signals from said second sensor; compare the first profile to the second profile based on the distance between said first sensor and said second sensor; and determine an accuracy of the fault indication based upon the generated component profile and the comparison. ### Claim 2 (depends on 1) The system in accordance with claim 1, wherein said fault detection computer device is further configured to: store a plurality of profiles corresponding to a plurality of faults; and compare the generated component profile with the stored plurality of profiles; wherein the determination of the accuracy of the fault indication is further based on the comparison of the generated component profile with the stored plurality of profiles. ### Claim 3 (depends on 2) The system in accordance with claim 2, wherein said fault detection computer device is further configured to determine at least one potential sensor error based on the comparison of the generated component profile with the stored plurality of profiles. ### Claim 4 (depends on 3) The system in accordance with claim 3, wherein said fault detection computer device is further configured to issue a maintenance request based on the at least one potential sensor error. ### Claim 5 (depends on 1) The system in accordance with claim 1, wherein the generated component profile includes a total harmonic distortion of the signals of said one or more sensors. ### Claim 6 (depends on 1) The system in accordance with claim 1, wherein the generated component profile includes a total harmonic distortion of the signals of said one or more sensors over a period of time prior to the fault and a period of time after the fault. ### Claim 7 (depends on 1) The system in accordance with claim 1, wherein said fault detection computer device is further configured to determine a potential cyber-attack based on the accuracy of the fault indication. ### Claim 8 (depends on 1) The system in accordance with claim 1, wherein the component is at least one of a substation load tap changer, a substation voltage regulator, a line voltage regulator, a capacitor bank, a single-phase transformer, a multi-phase transformer, and a customer meter. ### Claim 9 (depends on 1) The system in accordance with claim 1, wherein said fault detection computer device is further configured to disable the component based at least in part on the accuracy of the fault indication. ### Claim 10 (depends on 1) The system in accordance with claim 1, wherein said fault detection computer device is further configured to at least one of disable and ignore an output from at least one of the sensors of the one or more sensors based at least in part on the accuracy of the fault indication. ### Claim 11 A computer-based method for detecting false data injection attacks, said method implemented using a fault detection computer device including at least one processor in communication with a memory, said method comprising: receiving signals representing measurement data from the one or more sensors that monitor a component and generate signals representing the measurement data associated with the component; receiving signals from a first sensor and a second sensor of the one or more sensors, wherein the first sensor is proximate to the component and the second sensor is a distance from the first sensor; receiving a fault indication of a fault associated with the component; generating a component profile for the component based on the measurement data; determining a first profile based on the signals from the first sensor; determining a second profile based on the signals from the second sensor; comparing the first profile to the second profile based on the distance between the first sensor and the second sensor; and determining an accuracy of the fault indication based upon the generated component profile and the comparing. ### Claim 12 (depends on 11) The method in accordance with claim 11, further comprising: storing a plurality of profiles corresponding to a plurality of faults; and comparing the generated component profile with the stored plurality of profiles; wherein the determining the accuracy of the fault indication is further based on the comparison of the generated component profile with the stored plurality of profiles. ### Claim 13 (depends on 12) The method in accordance with claim 12, further comprising determining at least one potential sensor error based on the comparison of the generated component profile with the stored plurality of profiles. ### Claim 14 (depends on 11) The method in accordance with claim 11, wherein the generated component profile includes a total harmonic distortion of the signals of the one or more sensors. ### Claim 15 (depends on 11) The method in accordance with claim 11, wherein the generated component profile includes a total harmonic distortion of the signals of the one or more sensors over a period of time prior to and a period of time after the fault. ### Claim 16 (depends on 11) The method in accordance with claim 11, further comprising determining a potential cyber-attack based on the accuracy of the fault indication. ### Claim 17 A computer-readable storage device having processor-executable instructions embodied thereon, for detecting false data injection attacks, wherein when executed by a fault detection computer device communicatively coupled to a memory, the processor-executable instructions cause the fault detection computer device to: receive signals representing measurement data from the one or more sensors that monitor a component and generate signals representing the measurement data associated with the component; receive signals from a first sensor and a second sensor of the one or more sensors, wherein the first sensor is proximate to the component and the second sensor is a distance from the first sensor: receive a fault indication of a fault associated with the component; generate a component profile for the component based on the measurement data; determine a first profile based on the signals from the first sensor: determine a second profile based on the signals from the second sensor; compare the first profile to the second profile based on the distance between said the first sensor and said second sensor; and determine an accuracy of the fault indication based upon the generated component profile and the comparison. ### Claim 18 (depends on 17) The computer readable storage device of claim 17, wherein the processor-executable instructions cause the fault detection computer device to: store a plurality of profiles corresponding to a plurality of faults; compare the generated component profile with the stored plurality of profiles; and wherein the determination of the accuracy of the fault indication is further based on the comparison.