Identifying the anomaly location and type (fault or attack) is of paramount importance for enhancing cyber-physical situational awareness, and taking informed and effective mitigation actions in power distribution systems with an increasing number of attack points in distributed and renewable energy sources. This article proposes the fault and attack location and classification (FALCON) system to classify and locate cyber and physical anomalies, including false data injection attacks on protection devices, replay attacks on communication networks, and physical faults on distribution lines. The proposed system takes as input the transient short-circuit current and voltage measured by protection relays, the relays command status as well as the fault alarm from fault indicators, which is fed into a deep neural network that classifies and identifies the location of the fault and attacks in the distribution system. Numerical studies demonstrate FALCON's capability to classify and locate multiple cyber and physical anomalies with more than 98% accuracy, even when multiple devices are simultaneously compromised. Furthermore, the impact of different sets of input data is explored to highlight the importance of fault indicators, fault voltage data, and data collected from the RES relays.

中文翻译：

---

配电系统中集成的网络和物理异常定位和分类

识别异常位置和类型（故障或攻击）对于增强网络物理态势感知以及在配电系统中采取明智有效的缓解措施至关重要，因为分布式和可再生能源中的攻击点越来越多。本文提出了故障和攻击定位与分类（FALCON）系统来对网络和物理异常进行分类和定位，包括对保护设备的虚假数据注入攻击、对通信网络的重放攻击以及对配电线路的物理故障。所提出的系统以保护继电器测量的瞬态短路电流和电压、继电器命令状态以及故障指示器的故障报警作为输入，它被输入到一个深度神经网络中，该网络对配电系统中的故障和攻击进行分类和识别。数值研究表明 FALCON 能够以超过 98% 的准确率对多个网络和物理异常进行分类和定位，即使在多个设备同时受到攻击时也是如此。此外，还探讨了不同输入数据集的影响，以突出故障指示器、故障电压数据和从 RES 继电器收集的数据的重要性。