# US 2016/0366170 A1 · Systems and methods of detecting utility grid intrusions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2016/0366170 A1 - Document ID: US20160366170A1 - Status: Published application - Kind: A1 - Application number: 15/018,596 - Filed: 2016-02-08 - Published: 2016-12-15 - Earliest claimed: 2015-02-09 - Assignees: Utilidata, Inc. - Applicants: Utilidata, Inc. - Inventors: David Gordon Bell - Web page: https://patentgrep.com/patent/US20160366170A1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G01D 4/004: {Remote reading of utility meters to a fixed location} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G01D 2204/22: Arrangements for detecting or reporting faults, outages or leaks - Y02B 90/20: Smart grids as enabling technology in buildings sector (smart grids supporting the management or operation of end-user stationary applications in general, or like technologies with no associated climate change mitigation effect Y04S20/00) - Y04S 20/30: Smart metering, e.g. specially adapted for remote reading - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G01D: MEASURING NOT SPECIALLY ADAPTED FOR A SPECIFIC VARIABLE; ARRANGEMENTS FOR MEASURING TWO OR MORE VARIABLES NOT COVERED IN A SINGLE OTHER SUBCLASS; TARIFF METERING APPARATUS; MEASURING OR TESTING NOT OTHERWISE PROVIDED FOR - Y02B: CLIMATE CHANGE MITIGATION TECHNOLOGIES RELATED TO BUILDINGS, e.g. HOUSING, HOUSE APPLIANCES OR RELATED END-USER APPLICATIONS - Y04S: SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS ## Abstract Systems and methods of detecting an attack in a utility grid are described. An anomaly detector establishes a first metric generated using signals received from at least one of one or more controllers of the utility grid or one or more metering devices of the utility grid. The first metric identifies nominal behavior of control or consumption in the utility grid absent anomalies. The anomaly detector monitors signals received from the controllers or the metering devices. The anomaly detector determines, using the monitored signals, a second metric identifying current behavior of at least one of control or consumption in the utility grid. The anomaly detector compares the first metric with the second metric to detect an anomaly in control or consumption in the utility grid. The anomaly is attributable to an attack on a controller or a metering device. The anomaly detector provides an alert indicating the detected anomaly. ## Claims ### Claim 1 A method of detecting an attack in a utility grid, comprising: establishing, by an anomaly detector executing on one or more processors, a first metric using signals received from at least one of one or more controllers of the utility grid or one or more metering devices of the utility grid, the first metric identifying nominal behavior of at least one of control or consumption in the utility grid absent anomalies; monitoring, by the anomaly detector, signals received from at least one of the one or more controllers or the one or more metering devices; determining, by the anomaly detector, using the monitored signals a second metric identifying current behavior of at least one of control or consumption in the utility grid; comparing, by the anomaly detector, the first metric with the second metric to detect an anomaly in at least one of control or consumption in the utility grid, wherein the anomaly is attributable to an attack on at least one of a controller of the one or more controllers or a metering device of the one or more metering devices; and providing, by the anomaly detector, an alert indicating the detected anomaly. ### Claim 2 (depends on 1) The method of claim 1, comprising: establishing, by the anomaly detector, the first metric as a first consumption metric and a first control metric; establishing, by the anomaly detector, the second metric as a second consumption metric and a second control metric; comparing, by the anomaly detector, the first metric with the second metric to detect the anomaly in an interaction between a control process of the one or more controllers and consumption observed via the one or more metering devices. ### Claim 3 (depends on 1) The method of claim 1, comprising: establishing, by the anomaly detector, the first metric as a first consumption metric; establishing, by the anomaly detector, the second metric as a second consumption metric; comparing, by the anomaly detector, the first consumption metric with the second consumption metric to detect the anomaly in consumption observed via the one or more metering devices, wherein the anomaly is attributable to the attack on the metering device of the one or more metering devices; and providing, by the anomaly detector, the alert indicating the detected anomaly and identifying the metering device affected by the attack that causes the anomaly. ### Claim 4 (depends on 1) The method of claim 1, comprising: establishing, by the anomaly detector, the first metric as a first control metric; establishing, by the anomaly detector, the second metric as a second control metric; comparing, by the anomaly detector, the first control metric with the second control metric to detect the anomaly in a control process of the one or more controllers, wherein the anomaly is attributable to an attack on the controller of the one or more controllers; and providing, by the anomaly detector, the alert indicating the detected anomaly and identifying the controller affected by the attack that causes the anomaly. ### Claim 5 (depends on 1) The method of claim 1, wherein the attack comprises at least one of malware installed on the controller or the metering device configured to cause the anomaly, or malware installed on a third party device configured to attack the controller or the metering device via a network to cause the anomaly. ### Claim 6 (depends on 1) The method of claim 1, comprising: determining, by the anomaly detector, the first metric and the second metric based on one or more energy delivery process metrics comprising at least one of primary voltage information received via the one or more metering devices, secondary voltage information received via an advanced metering infrastructure (AMI) system, real energy or reactive energy observed at one or more devices located on a primary level of the utility grid, or voltage information observed at one or more delivery sites. ### Claim 7 (depends on 1) The method of claim 1, comprising: establishing, by the anomaly detector, the first metric and the second metric based on at least one of a covariance of a scalar stochastic time series, correlation of a scalar stochastic time series, entropy of a scalar stochastic time series, or a transfer function of a system representing the utility grid. ### Claim 8 (depends on 1) The method of claim 1, comprising: comparing, by the anomaly detector, the first metric with the second metric to detect the anomaly using at least one of a vector threshold, a linear discriminant technique, or a neural network. ### Claim 9 (depends on 1) The method of claim 1, comprising: providing, by the anomaly detector via a network, the alert to a supervisory system of the utility grid, the alert configured to cause the supervisory system to adjust an operation parameter of the controller or the metering device. ### Claim 10 (depends on 1) The method of claim 1, comprising: generating, by the anomaly detector, the first metric for a geographic area using at least one of temperature information, humidity information, cloud cover information, or seasonal insolation; and generating, by the anomaly detector, the second metric for the same geographic area to detect the anomaly. ### Claim 11 A system to detect an attack in a utility grid, comprising: a metric detector executed by one or more processors configured to establish a first metric using signals received from at least one of one or more controllers of the utility grid or one or more metering devices of the utility grid, the first metric identifying nominal behavior of at least one of control or consumption in the utility grid absent anomalies; the metric detector further configured to monitor signals received from at least one of the one or more controllers or the one or more metering devices; the metric detector further configured to determine using the monitored signals a second metric identifying current behavior of at least one of control or consumption in the utility grid; a metric discriminator executed by the one or more processors configured to compare the first metric with the second metric to detect an anomaly, wherein the anomaly is attributable to an attack on at least one of a controller of the one or more controllers or a metering device of the one or more metering devices; and an alert generator executed by the one or more processors configured to provide the alert indicating the detected anomaly. ### Claim 12 (depends on 11) The system of claim 11, comprising: the metric detector further configured to establish the first metric as a first consumption metric and a first control metric; the metric detector further configured to establish the second metric as a second consumption metric and a second control metric; the metric discriminator further configured to compare the first metric with the second metric to detect the anomaly in an interaction between a control process of the one or more controllers and consumption observed via the one or more metering devices. ### Claim 13 (depends on 11) The system of claim 11, comprising: the metric detector further configured to establish the first metric as a first consumption metric; the metric detector further configured to establish the second metric as a second consumption metric; the metric discriminator further configured to compare the first consumption metric with the second consumption metric to detect the anomaly in consumption observed via the one or more metering devices, wherein the anomaly is attributable to the attack on the metering device of the one or more metering devices; and the alert generator further configured to provide the alert indicating the detected anomaly and identifying the metering device affected by the attack that causes the anomaly. ### Claim 14 (depends on 11) The system of claim 11, comprising: the metric detector further configured to establish the first metric as a first control metric; the metric detector further configured to establish the second metric as a second control metric; the metric discriminator further configured to compare the first control metric with the second control metric to detect the anomaly in a control process of the one or more controllers, wherein the anomaly is attributable to an attack on the controller of the one or more controllers; and the alert generator further configured to provide the alert indicating the detected anomaly and identifying the controller affected by the attack that causes the anomaly. ### Claim 15 (depends on 11) The system of claim 11, wherein the attack comprises at least one of malware installed on the controller or the metering device configured to cause the anomaly, or malware installed on a third party device configured to attack the controller or the metering device via a network to cause the anomaly. ### Claim 16 (depends on 11) The system of claim 11, comprising: the metric detector further configured to determine the first metric and the second metric based on one or more energy delivery process metrics comprising at least one of primary voltage information received via the one or more metering devices, secondary voltage information received via an advanced metering infrastructure (AMI) system, real energy or reactive energy observed at one or more devices located on a primary level of the utility grid, or voltage information observed at one or more delivery sites. ### Claim 17 (depends on 11) The system of claim 11, comprising: the metric detector further configured to establish the first metric and the second metric based on at least one of a covariance of a scalar stochastic time series, correlation of a scalar stochastic time series, entropy of a scalar stochastic time series, or a transfer function of a system representing the utility grid. ### Claim 18 (depends on 11) The system of claim 11, comprising: the metric discriminator further configured to compare the first metric with the second metric to detect the anomaly using at least one of a vector threshold, a linear discriminant technique, or a neural network. ### Claim 19 (depends on 11) The system of claim 11, comprising: the alert generator further configured to provide, via a network, the alert to a supervisory system of the utility grid, the alert configured to cause the supervisory system to adjust an operation parameter of the controller or the metering device. ### Claim 20 (depends on 11) The system of claim 11, comprising: the metric detector further configured to generate the first metric for a geographic area using at least one of temperature information, humidity information, cloud cover information, or seasonal insolation; and the metric detector further configured to generate the second metric for the same geographic area to detect the anomaly.