Proceedings of the 10^th International Conference on Global Energy Meet (GEM – 2026)

The rapid adoption of inverter-based resources (IBRs), such as solar energy, has expanded the attack surface of the power grid, increasing its vulnerability to cyberattacks. Consequently, there is an urgent need for distributed attack detection methods that locally integrate with IBRs without disrupting normal system operation. Natural watermarking, which leverages inherent direct current link voltage fluctuations caused by the variability of renewable energy sources, has emerged as a promising solution for attack detection. However, this approach has yet to be demonstrated under realistic conditions. This study addresses this gap by implementing a natural watermarking scheme in both a hardware-in-the-loop simulation of a three-phase grid-tied photovoltaic inverter and a fully hardware-based system. A Texas Instruments C2000 F280049C LaunchPad is used both to control the inverter and to implement real-time state-space estimations, which form a digital twin of the inverter. This digital twin is then used to detect abnormal inverter behavior by identifying discrepancies between predicted and measured system outputs. Validation results confirm the effectiveness of the proposed approach in detecting noise-injection and replay attacks in both testbeds. Additionally, unpredictable direct current link voltage fluctuations arising from variations in irradiance enable the detection of model-based attacks that would otherwise remain undetectable. This study thus demonstrates the practical viability and robustness of natural watermarking as a locally implementable, non-intrusive cybersecurity measure for inverterbased power systems.

PDF (Download Full text)