A Normal Behavior Model Based on Machine Learning for Wind Turbine Cyber-Attack Detection

Abstract

As the global power landscape increasingly incorporates wind energy, wind turbine infrastructure has become a target for sophisticated cyber-attacks. These cyber-attacks, ingeniously crafted to infiltrate the cyber layer of wind turbine cyber-physical systems, can significantly impair system performance and potentially lead to severe cascading damages, aligned with the attackers' nefarious objectives. The stealthy nature of these sophisticated cyber-attacks renders their anomalous behaviors and patterns more challenging to identify than conventional faults, highlighting the urgent need for novel, specialized anomaly detection strategies tailored to wind turbine cyber-attacks. Addressing this critical concern, this paper proposes a machine learning-based normal behavior modeling approach designed to effectively detect anomalies induced by a new coordinated type of stealthy cyber-attack on wind turbines. This is achieved through advanced analysis and processing of the system's measured data, along with precise residual generation and evaluation. The efficiency of the proposed approach is demonstrated using an offshore wind turbine benchmark, factoring in wind turbulence, measurement noise, and complex cyber-attack scenarios.