US Patent 10015184 Emulating regulating device to detect utility grid intrusions

Systems and methods of detecting an attack in a utility grid are described. An anomaly detector identifies a first indication of signal samples used by a controller to adjust a voltage level at a load terminal during a first time interval, and a first indication of voltage levels at the load terminal of the controller. The anomaly detector identifies a regulator emulation model (“REM”) for the controller. The anomaly detector receives a second indication of signal samples used by the controller during a second time interval, and a second indication of a voltage level at the load terminal. The anomaly detector detects a level of conformance with the REM based on a comparison of the second indication of the voltage levels with a voltage level determined by inputting the second indication of the signal samples into the REM. The anomaly detector provides a notification indicating an anomaly with the controller.