Cyber-attack on synchrophasor data has become a widely explored area. However, GPS-spoofing and FDIA attacks require different responsive actions. State-estimation based attack detection method works similar way for both types of attacks. It implies that using state-estimation based detection alone doesn’t give the control center enough information about the attack type. This scenario is specifically more critical for those attack detection methods which consider GPS-spoofing attack as another FDIA with falsified phase angle data. Since identifying correct attack type is paramount, we have attempted to develop an algorithm to distinguish these two attacks. Previous researchers exploited low-rank approximation of Hankel Matrix to differentiate between FDIA and physical events. We have demonstrated that, together with angle unwrapping algorithm, low-rank approximation of Hankel Matrix can help us separating GPS-spoofing attack with FDIA.

The proposed method is verified with simulation result. It has been demonstrated that the GSA with 3 second time-shift creates a low-rank approximation error 700% higher than that of normal condition, whereas FDIA doesn’t produce any significant change in low-rank approximation error from that of normal condition. Finally, we have proposed a real-time method for successful identification of event, FDIA and GSA.