Cyberattack Detection and Mitigation of False Data Injection in Grid-Connected PV Inverters Using Residual-Based Monitoring and PV-Side Recovery

Abstract

The increasing connectivity of photovoltaic (PV) systems and their associated control infrastructures creates new opportunities for cyberattacks that can directly affect inverter operation. This paper investigates a false data injection attack (FDIA) targeting the DC-link voltage measurement of a grid-connected PV inverter. A 250-kW grid-connected PV system implemented in MATLAB/Simulink is considered to examine the effect of the attack on the inverter control response and power conversion performance. A residual-based detection mechanism is developed to identify abnormal changes in the measured DC-link voltage. The residual is monitored against a predefined threshold, and an alarm is generated when the deviation exceeds the threshold. A detection delay is also incorporated into the protection logic to account for the finite time required to activate the recovery action after an attack is detected. Following detection, a PV-side measurement-based recovery mechanism is used to reconstruct the affected voltage signal and provide the inverter controller with a replacement value. The system is evaluated under normal, attack, and recovery conditions. Under the attack scenario, V_{dc_mean} decreases from 481.6 V to 334.6 V, while P_dc decreases from 241.5 kW to 177.1 kW and I_{d_ref} reaches 1.5 pu. After the recovery action, V_{dc_mean} returns to approximately 481 V, P_dc is restored to 241.5 kW, and I_{d_ref} decreases to 0.9501 pu. The results demonstrate that the considered detection and recovery strategy can effectively reduce the impact of the investigated FDIA on PV inverter operation.