A Multi-Layer False Data Injection Attack on DFIG Wind Turbine Protection and a Wind-Speed Cross-Check Defense

Abstract

Wind turbines based on doubly-fed induction generators are increasingly exposed to cyber-physical threats that target their protection systems. This paper investigates a multi-layer false data injection attack that manipulates the measured rotor speed in a DFIG-based wind turbine to prevent overspeed tripping during storm conditions. The attack is designed to remain inactive until the rotor speed approaches the protection threshold, enabling a stealthy and context-aware activation. Beyond the overspeed relay, the attack also suppresses subsequent protection stages, including delay protection and minimum voltage protection, forming a coordinated and adaptive threat. To counter this, a wind-speed cross-check defense is proposed. The defense continuously compares the reported rotor speed with the actual wind speed and issues a trip command when a sustained inconsistency is detected. Simulation results on a standard MATLAB/Simulink DFIG phasor model demonstrate that the attack successfully avoids turbine tripping during a severe wind gust, while the proposed defense detects the abnormal condition and trips the turbine shortly after the storm begins. The study also examines three attack timing strategies and shows that launching the attack before the storm provides the highest likelihood of success. The findings emphasize the importance of independent protection layers and physics-informed monitoring in cyber-physical wind energy systems.