Distributed Snitch Digital Twin-Based Anomaly Detection for Smart Voltage Source Converter-Enabled Wind Power Systems

Abstract: Existing cyberattack detection methods for smart grids such as Artificial Neural Networks (ANNs) and Deep Reinforcement Learning (DRL) often suffer from limited adaptability, delayed response, and inadequate coordination in distributed energy systems. These techniques may struggle to detect stealthy or coordinated attacks, especially under communication delays or system uncertainties. This paper proposes a novel Snitch Digital Twin (Snitch-DT) architecture for cyber-physical anomaly detection in grid-connected wind farms using Smart Voltage Source Converters (VSCs). Each wind generator is equipped with a local Snitch-DT that compares real-time operational data with high-fidelity digital models and generates trust scores for measured signals. These trust scores are coordinated across nodes to detect distributed or stealthy cyberattacks. The performance of the Snitch-DT system is benchmarked against previously published Artificial Neural Network (ANN) and Deep Reinforcement Learning (DRL)-based detection frameworks. Simulation results using an IEEE 39-bus wind-integrated test system demonstrate improved attack detection accuracy, faster response time, and higher robustness under various cyberattack scenarios.

• The paper presents a distributed Snitch-DT framework that uses residual analysis and dynamic trust scores for real-time anomaly detection in smart VSC-enabled wind power systems.
• It achieves superior performance with a detection accuracy of 95%, low false positive/negative rates (10%/8%), and a rapid detection delay of only 100 steps compared to DRL and ANN methods.
• The framework offers improved reactive power tracking with an RMSE of 0.05 pu and scalable, real-time operation without the need for extensive offline training.

Distributed Snitch Digital Twin-Based Anomaly Detection for Smart VSC-Enabled Wind Power Systems

Introduction

The integration of distributed renewable generation, particularly wind energy enabled via Smart Voltage Source Converters (VSCs), introduces significant challenges for cyber-physical security in the power grid due to the increased digitalization, decentralized architecture, and dynamic control requirements. While standards such as IEEE 2800-2022 and IEEE 1547 have formalized interoperability for inverter-based resources (IBRs), new attack surfaces and vulnerabilities emerge, notably in the advanced control loops governing real-time voltage and reactive power regulation.

Recent advancements in anomaly detection employ Artificial Neural Networks (ANNs), Deep Reinforcement Learning (DRL), and associated supervised methods. However, these approaches generally exhibit insufficient adaptability, high latency, limited scalability under communication delays, and poor performance against stealthy or spatially correlated attacks. This paper proposes a novel Snitch Digital Twin (Snitch-DT) framework designed to overcome these deficiencies by exploiting physics-informed digital twins with distributed, cooperative trust-based coordination.

Snitch Digital Twin (Snitch-DT) Architecture

The Snitch-DT method extends conventional digital twin architectures by embedding real-time anomaly detection capabilities through residual analysis and dynamic trust score computation. Each wind generator's VSC is equipped with a local Snitch-DT module—a high-fidelity co-simulated digital replica that continuously compares measured physical signals (e.g., grid voltage, current, reactive power) with its own simulation outputs, assuming attack-free conditions.

Anomaly detection is achieved via:

• Residual Generation: The module calculates the residual $r(t) = V_\mathrm{out}(t) - V^*_\mathrm{out}(t)$, triggering an anomaly flag if $|r(t)| > \varepsilon$, with $\varepsilon$ calibrated according to measurement noise and model uncertainty.
• Trust Score Mechanism: A time-evolving trust score $T(t)$, computed using a rolling-window variance of the residual, reflects the health of each node. Scores are continuously shared and aggregated across nodes via a consensus protocol to enable both local and system-wide anomaly inference, crucial for detecting spatially coordinated attacks.

Such a distributed approach directly addresses the temporal and spatial limitations of previous node-isolated and centralized detection schemes.

Benchmarking and Attack Scenarios

The evaluation employs a detailed MATLAB/Simulink implementation on an IEEE 39-bus system with multi-nodal wind integration. Three detection strategies are benchmarked:

1. Snitch-DT (proposed): Model-based, residual-driven, distributed.
2. DRL (Deep Q-Network/PPO): Model-free, policy-learning, offline trained.
3. Supervised ANN: Statistical estimation with offline training.

Attack scenarios include:

• False Data Injection (FDI): Both bias jump and ramp attacks manipulated reactive power setpoints, testing the sensitivity to abrupt and progressive compromises.
• Delay Attacks: Introduced communication latency directly in the VSC feedback, evaluating robustness under time synchrony violations.
• Coordinated Multi-node Attacks: Examined the detection capacity for spatially correlated, stealthy adversarial actions.

Performance is measured using detection accuracy, false positive/negative rates (FPR/FNR), detection latency, reactive power tracking RMSE, computation time, and F1 score.

Results and Comparative Analysis

Strong numerical results are reported for the Snitch-DT approach:

• Detection Accuracy: 95%, substantially exceeding DRL (85%) and ANN (82%).
• FPR/FNR: Lowest for Snitch-DT (10%/8%), superior to DRL and ANN.
• Detection Delay: Snitch-DT achieves the fastest event localization at 100 steps, compared to 400 for DRL and 600 for ANN.
• Reactive Power Tracking RMSE: Snitch-DT at 0.05 pu, outperforming DRL (0.15 pu) and ANN (0.25 pu).
• Computation Time: Favorable for real-time applications due to parallel, local execution.

ROC/AUC analysis confirms Snitch-DT’s improved discriminative capability across all attack types. Notably, the architecture achieves these results without requiring offline training or extensive historical datasets, enhancing adaptability to novel or evolving attack patterns.

A key claim substantiated in this work is that the Snitch-DT’s local-physical plus coordinated trust aggregation enables robust, low-latency detection of both local and coordinated stealthy attacks—a challenge for prevailing AI-driven or purely data-centric methods.

Implications and Future Directions

The Snitch-DT architecture represents a substantial step toward resilient, scalable, and explainable anomaly detection for VSC-enabled wind power systems. Its distributed, model-based nature—with dynamic trust scores—supports both individualized and coordinated mitigation strategies, addressing critical concerns for grid reliability under increasing renewable penetration and cyberattack risk.

Practically, the method aligns with grid modernization objectives and regulatory mandates for DER cybersecurity. Theoretically, it prompts further investigation into self-adaptive digital twins, online learning mechanisms integrated into the twin models, and seamless coupling of detection with real-time control mitigation (e.g., automatic setpoint rewinding and attack containment).

Prospective research could include:

• Extending Snitch-DT with adaptive learning for model drift resistance.
• Tight integration of detection and autonomous correction at both local and consensus levels.
• Scaling to city- or country-scale renewable portfolios.
• Formal verification and certification for compliance-critical energy systems.

Conclusion

This study demonstrates that distributed Snitch Digital Twin-based anomaly detection outperforms supervised ANN and DRL methods in accuracy, responsiveness, and resilience for smart VSC-enabled wind power systems. By leveraging local virtual-physical mirroring and cross-node trust aggregation, the Snitch-DT framework is poised as a robust, real-time solution to the emerging cybersecurity challenges inherent in the next generation of digitalized grid infrastructures (2604.03123).