Residential Demand Response Behaviour Modeling applied to Cyber-physical Intrusion Detection

A real-time demand response system can be viewed as a cyber-physical system, with physical systems dependent on cyber infrastructure for coordination and control, which may be vulnerable to cyber-attacks. The time domain dynamic behaviour of individual residential demand responses is governed by a mix of physical system parameters, exogenous influences, user behaviour and preferences, which can be characterized by unstructured models such as a time-varying finite impulse response. In this study, which is based on field data, it is shown
how this characteristic response behaviours can be identified and how the characterization can be updated continuously. Finally, we propose an approach to apply this behaviour characterization to the identification of anomalous and potentially malicious behaviour modifications as part of a cyber-physical intrusion detection mechanism.