System and method for anomaly and cyber-threat detection in a wind turbine

A method to protect a wind turbine associated with a plurality of monitoring nodes from a cyber-attack at a physical domain level of the wind turbine, each monitoring node generating a series of current monitoring node values over time that represent a current operation of the wind turbine, comprising:

• receiving a series of current monitoring node values from a plurality of monitoring nodes each generating a series of current monitoring node values over time that represent a current operation of the wind turbine;
• generating a set of current feature vectors based on the series of current monitoring node values;
• accessing, by an abnormality detection computer platform, an abnormality detection model having a plurality of decision boundaries created using wind information along with at least one of a set of normal feature vectors and a set of abnormal feature vectors for each of the monitoring nodes, wherein the abnormal feature vectors are generated from abnormal monitoring node values over time that represent a cyber-attack on the wind turbine at the physical domain level of the monitoring nodes resulting in the abnormal monitoring node values;
• for each of the monitoring nodes, selecting one of the decision boundaries based on current wind information associated with the wind turbine;
• executing the abnormality detection model and transmitting an abnormality alert signal based on the set of current feature vectors and the selected decision boundary, the alert signal generating an automatic response to a cyber-attack;
• and
• wherein the abnormality detection model includes a below-rated normal power production decision boundary and an above-rated normal power production decision boundary, and said selection is based at least in part on a current wind speed and a threshold value associated with the wind turbine reaching its rated power.

A non-transitory, computer-readable medium storing instructions that, when executed by a computer processor, cause the computer processor to perform a method to protect a wind turbine from a cyber-attack at a physical domain level of the wind turbine, the method comprising:

• receiving a series of current monitoring node values from a plurality of monitoring nodes each generating a series of current monitoring node values over time that represent a current operation of the wind turbine;
• generating a set of current feature vectors based on the series of current monitoring node values;
• accessing, by an abnormality detection computer platform, an abnormality detection model having a plurality of decision boundaries created using wind information along with at least one of a set of normal feature vectors and a set of abnormal feature vectors for each of the monitoring nodes, wherein the abnormal feature vectors are generated from abnormal monitoring node values over time that represent a cyber-attack on the wind turbine at the physical domain level of the monitoring nodes resulting in the abnormal monitoring node values;
• selecting one of the decision boundaries based on current wind information associated with the wind turbine;
• executing the abnormality detection model and transmitting an abnormality alert signal based on the set of current feature vectors and the selected decision boundary, the alert signal generating an automatic response to a cyber-attack;
• and
• wherein the abnormality detection model includes a below-rated normal power production decision boundary and an above-rated normal power production decision boundary, and said selection is based at least in part on a current wind speed and a threshold value associated with the wind turbine reaching its rated power.