Identification of Cyberattacks Targeting Poorly-Damped Modes in Wind-Integrated Grids

In a wind power plant (WPP), cyberattacks are possible due to existing vulnerabilities in communication protocols, multi-level control loops, extensive data transfers, and the remote locations of wind turbines (WTs). The physical impacts of such threats against WPP can propagate into the wide-area grid and result in a blackout. This paper introduces a novel attack model in which adversaries exploit cybersecurity vulnerabilities in wind power plants (WPPs) to conduct false data injection (FDI) attacks. By using sinusoidal signals, these attacks can destabilize poorly damped modes (PDMs) within bulk power grids, posing a risk of widespread blackouts even with low WPP integration. We propose a model-based detection method that analyzes spectral data from WPP control centers, in compliance with IEC 61400-25. A detection threshold is established using power spectrum density (PSD) distributions, and a fuzzy logic controller (FLC) is incorporated to manage operational uncertainties. Validation on the New England 39-bus and Simplified 16-Generator Australian Power System confirms the effectiveness of the proposed detection approach in the presence of either Gaussian or non-Gaussian noises and coordinated attacks.