Qiuhua Huang

As distributed energy resources (DERs) and DER aggregators are integrated into distribution systems, the attack surface of critical power infrastructure expands. Built-in cryptography is effective against some false data injection (FDI) attacks, man-in-the-middle attacks, and tampered data from unauthenticated sources but cannot detect denial of service (DoS) attacks or FDI attacks originating from already-authenticated devices. This paper proposes a Dual-Tier Cyberattack Detection (DTCD) algorithm implemented within a DER aggregator that detects cyberattacks within the cyber and physical layers of a DER-integrated distribution system. The first tier, or cyber filter (CF), applies rule-based cyber checks to detect protocol-level DoS attacks, including TCP floods, SYN floods, and port scan attacks, and timestamp-based FDI anomalies. The second tier, or voltage anomaly detector (VAD), applies a physics-based Gradient Boosting Machine (GBM) dual-fusion model to detect event-driven FDI attacks by evaluating whether observed bus voltage deviations can be explained by expected load or photovoltaic (PV) changes. The algorithm is validated in real-time hardware-in-the-loop (HIL) testing on the PNNL powerNET cyberphysical testbed using an IEEE 123 bus model with DNP3 communication. CF detects all four tested attack signatures under partially mitigated traffic conditions with sub-50 ms detection times. VAD achieves a pooled F1-score of 0.875 and a receiver operating characteristic area under the curve (ROC AUC) of 0.802 across six attack scenarios at three operating conditions and four test days. VAD completes analysis in 2363 ms on average, within the sub-SCADA timeline. A two-tier comparison study shows that DTCD’s cyber check and physics-based tiers outperform cryptographic and signature-based intrusion detection approaches in the first tier and a standalone-GBM approach in the second tier. The two tiers operate in parallel and provide complementary coverage of DoS and FDI attacks. Replacing CF misses timestamp anomalies, and replacing VAD lowers the FDI F1-score. Results demonstrate that the proposed algorithm effectively complements cryptographic prevention as a detection layer, can provide cybersecurity coverage for legacy devices through aggregator-level packet screening, and completes its analysis within the sub-SCADA operational window.

False data injection attacks (FDIAs) pose a growing threat to distributed energy resource (DER) aggregators because a compromised aggregator can expose and affect a number of enrolled DERs. However, DER aggregators only have access to limited measurements from DERs and the systems. This makes existing FDIA detection methods ineffective in this setting due to two main limitations: (1) they are grounded in full observability of a microgrid or distribution system and therefore are incompatible with the limited observability of a DER aggregator; (2) they can only either detect anomalies or explain why a deviation occurs, but not both simultaneously. To address these limitations, we propose a physics-guided fusion-based cyberattack detection method specifically designed for DER aggregators. This approach integrates two complementary modules: a forecasting-assisted residual method for rapidly anomaly detection, and a PV-aware sensitivity-based method to diagnose and explain their underlying physical causes. A gradient boosting machine (GBM) is then leveraged to fuse these outputs, optimizing the precision–recall tradeoff. The proposed method is tested on one microgrid test system with different bus observability levels across static and gradual attack scenarios with multiple levels of attack sophistication. Across the scenarios, the proposed method achieves a 0.91–0.93 precision–recall area under the curve score (PR-AUC), demonstrating the method’s effectiveness in securing DER aggregators with partial system visibility.

Residential distributed energy resources (DERs), including rooftop photovoltaic (PV) systems and battery energy storage systems (BESS), offer significant potential to improve building energy flexibility while reducing electricity costs and carbon emissions. However, effective coordination of them remains challenging because residential demand, PV generation, electricity prices, and marginal carbon emissions vary over time and are subject to forecasting uncertainty. This paper presents a forecast-informed and emission-aware Home Energy Management System (HEMS) based on Model Predictive Control (MPC) that provides a unified framework for comparing ideal MPC, deterministic MPC (DMPC), and scenario-based stochastic MPC (SMPC). The framework integrates deterministic and Bayesian LSTM load forecasting with predictive control, enabling probabilistic forecast uncertainty to be propagated into battery scheduling decisions through scenario-based optimization. The proposed approach is evaluated using BEopt-generated hourly load profiles for 28 residential buildings in Colorado, U.S., with representative households modeled under BESS and rooftop PV configurations. For a representative home under the battery+PV configuration, SMPC achieves a 10.6% reduction in monetized total cost relative to the no-battery baseline over a one-month evaluation period, closely approaching the ideal MPC benchmark of 12.3% and performing comparably to DMPC at 10.5%. Across representative homes, cost-focused operation achieves up to 13.3% electricity cost savings, emission-focused operation reduces emissions by up to 20.5%, and joint optimization provides simultaneous savings of up to 10.5% in cost and 17.2% in emissions. These results demonstrate that forecast-informed SMPC can support practical residential DER scheduling while balancing economic and environmental objectives under uncertain operation conditions.

False data injection attacks (FDIA) pose a growing threat to distributed energy resources (DER) aggregators because a compromised aggregator can expose and affect a number of enrolled DERs. However, DER aggregators only have access to limited measurements from DERs and the systems. This makes existing FDIA detection methods ineffective in this setting due to two main limitations: 1) they are grounded in full observability of a microgrid or distribution system, therefore are incompatible with the limited observability of a DER aggregator; 2) they can only either detect anomalies or explain why a deviation occurs, but not both of them simultaneously. To address these limitations, we propose a physics-guided fusion-based cyberattack detection method specifically designed for DER aggregators. This approach integrates two complementary modules: a forecasting-assisted residual method for rapidly anomaly detection, and a PV-aware sensitivity-based method to diagnose and explain their underlying physical causes. A gradient boosting machine (GBM) is then leveraged to fuse these output, optimizing the precision-recall tradeoff. The proposed method is tested on one microgrid test system across static and gradual attack scenarios with multiple levels of attack sophistication. Across the scenarios, the proposed method achieves a 93.34% accuracy, 0.88 F1-score, and 0.96 precision-recall area under the curve score (PR-AUC), demonstrating the method's effectiveness in securing DER aggregators with partial system visibility.

High penetration of distributed energy resources (DER) in distribution systems, such as rooftop solar PVs, has caused voltage fluctuations which are much faster than typical voltage control devices can react to, leading to increased operation cost and reduced equipment life. Residential buildings consume about 35% of the electricity in the U.S. and are co-located with rooftop solar PV. Thus, they present an opportunity to mitigate these fluctuations locally, while benefiting both the grid and building owners. Previous works on DER-aware localized building energy management mostly focus on commercial buildings and analyzing impacts either on buildings or the grid. To fill the gaps, this paper proposes a distributed, differential predictive control scheme for residential HVAC systems for maximizing renewable local consumption while maintaining occupant comfort. In addition, a detailed controller-building-grid co-simulation platform is developed and utilized for analyzing the potential impacts of the proposed control scheme on both buildings and distribution systems. Our studies show that the proposed method can provide benefits to both the buildings’ owners and the distribution system by reducing electricity bills by 5%, voltage violations and fast fluctuations by 48%, and the number of tap changes in voltage regulators by 19%.

An accurate forecast of electric demand is essential for the optimal design of a generation system. For district installations, the projected lifespan may extend one or two decades. The reliance on a single-year forecast, combined with a fixed load growth rate, is the current industry standard, but does not support a multi-decade investment. Existing work on long-term forecasting focuses on annual growth rate and/or uses time resolution that is coarser than hourly. To address the gap, we propose multiple statistical forecast models, verified over as long as an 11-year horizon. Combining demand data, weather data, and occupancy trends results in a hybrid statistical model, i.e., generalized additive model (GAM) with a seasonal autoregressive integrated moving average (SARIMA) of the GAM residuals, a multiple linear regression (MLR) model, and a GAM with ARIMA errors model. We evaluate accuracy based on: (i) annual growth rates of monthly peak loads; (ii) annual growth rates of overall energy consumption; (iii) preservation of daily, weekly, and month-to-month trends that occur within each year, known as the 'seasonality' of the data; and, (iv) realistic representation of demand for a full range of weather and occupancy conditions. For example, the models yield an 11-year forecast from a one-year training data set with a normalized root mean square error of 9.091%, a six-year forecast from a one-year training data set with a normalized root mean square error of 8.949%, and a one-year forecast from a 1.2-year training data set with a normalized root mean square error of 6.765%.