Grid Security via Anomaly Finding and Explanation (GridSAFE)

For the U.S. power grid to fail catastrophically, one or more utility-level or regional control systems must no longer be capable of balancing supply of power with nodal demand. Historically, these control systems have usually proven highly resilient, capable of accommodating large-scale generation outages (e.g., due to sudden disruptions to fuel supply), and substantial near-simultaneous transmission and distribution outages (e.g., caused by severe weather). When cascading failures have occurred, malfunctions of one or more major grid control systems have almost invariably been implicated. It follows that such systems present particularly important cyber vulnerabilities. This effort will build on and extend technology developed during our Phase 1 effort that constructed scalable graph-database-backed infrastructure for inferring latent relationships from large, diverse, streaming data sources. We will exploit this functionality for ingest and storage of the data needed to train models of real-time control of the electric power grid by Regional Transmission Organizations (RTOs) or Independent System Operators (ISOs) in response to fluctuations in demand or unexpected outages. We then detect anomalies relative to typical control responses, and evaluate them as potential cyber threats.