Real-Time AI-Based Anomaly Detection and Classification in Power Electronics Dominated Grids

Real-time anomaly detection system (ADS) and anomaly classification system (ACS) techniques are becoming a crucial need for future power electronic dominated grid (PEDG). Artificial intelligence techniques such as recurrent neural networks, specifically long short-term memory (LSTM) provide a promising solution to detect anomalies in power grids. The main challenge is the implementation of these methods for real-time detection and classification for preventing catastrophic failure in PEDG. This article is addressing the challenge for detection and classification of anomalies in real-time in PEDG. The proposed approach is based on integration of model predictive control (MPC) and LSTM for realizing real-time ADS and ACS. The LSTM detection network can utilize the same time-series input data as the MPC, allowing for anomaly classification and correction. The proposed integrated LSTM-MPC approach has features of power electronics internal failure detection and corrective actions, which is an important aspect in future PEDG to differentiate inverters internal failures versus anomalies. Such internal failures include open circuit fault that needs to be detected and classified from a potential cyber-attack, allowing resilient operation of PEDG. The proposed integrated LSTM-MPC scheme for real-time ADS and ACS scheme is tested on a realistic 14-bus system dominated with inverters forming PEDG.


I. INTRODUCTION
T HE power system is experiencing a massive change to be able to house ever-increasing distributed energy resources (DERs) across the grid, to decrease the dependency on nonrenewable-based sources, and shift it toward renewable resources, i.e., photovoltaics and wind. This new energy paradigm is called power electronics dominated grid (PEDG) [1]. With all the benefits the PEDG introduces, it brings up some challenges that need to be properly addressed prior to full implementation of such a complex system in the real world. Manuscript  These challenges include control, privacy, stability, planning, resilience, and cyber-physical security aspects [2]. The PEDG resilient operation is constrained with predefined boundaries for variables such as frequency, voltage, and power quality indices. Any anomaly could cause destructive consequences on the operation of the PEDG. These anomalies could have different characteristics such as component failure, faults, or malicious intrusive attacks. By considering the recent intrusive attempts on the power systems, cyber-physical security of the system gains extensive attention from governmental agencies and decision-making organizations, since it affects the national security. Thus, prevention, detection [4], mitigation [5], and, if needed, isolation of these cyber-physical intrusions are trending research topics for modern PEDG. High penetration of DERs in the grid requires various agents for proper functionality. These include smart meters, PMUs, observers, smart loads, and the hierarchical control architecture of the PEDG. Thus, it is necessary to incorporate multilayer anomaly detection and classification (MADC) systems performing in multiple timescales. This is inevitable to ensure the secure and seamless operation of the entire system.
One of the most common cyber-attacks on power systems is false data injection (FDI). FDIs target the data integrity of the system which would push the control system to adopt inadequate decisions [3], [4]. Attack consequences could vary, depending on the number of compromised assets, attacker's level of knowledge on the system, attack propagation, and its persistence [5], [6]. Even attacking one node of the system could impact the other nodes across the PEDG, since the compromised DER may impact the neighboring nodes' power quality and optimal operation of other DERs. The consequence of this attack is cascading failures across the grid. Thus, it is crucial for resilient operation of PEDG to isolate the anomalous nodes to avoid cascading failure across the PEDG that could results in catastrophic failure of the power grid.
The supervisory layer of the PEDG must be able to differentiate between these cyber intrusions and internal inverter failures to be able to make the most optimal decision for the PEDG. Without this knowledge, the supervisory layer will not be able to adopt the best decisions for a system with fleets of smart assets across it. In the literature, numerous inverter fault-tolerant control schemes are proposed [7], [8], [9], [10]. The existing solutions are mainly focusing on detection, location of the faulty switch, and updating the switching sequences accordingly. The missing piece of the puzzle in improving the This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/ resiliency of the PEDG is differentiating these internal faults from malicious intrusions. Differentiating between these allows for optimal corrective action. A critically important missing piece in exiting solutions is ensuring this process occurs in real-time. If the MADC cannot detect and classify the anomaly in a real-time-basis, the existing window for making proper decision might be missed.
The existing solutions for anomaly detection can be classified into two main categories, which are system model-based techniques [11], [12], and data-driven schemes [13], [14], [15], [16], [17]. Generally, in model-based approaches, a model of the system must be developed, and the system parameters must be estimated. Since there is not a training mechanism in model-based approaches, data mining is not needed. However, the main drawbacks of model-based techniques is scalability of the detection mechanism, meaning that if the system changes, a new model needs to be developed [18]. In model-based schemes, for detection purposes, usually an observer is designed to oversee the dynamic behavior of the system. The observers for these model-based techniques could use Kalman filter [19], principle component analysis [20], and weighted least-square [21]. These model-based techniques could be implemented in real-time applications. However, since they are highly dependent on the mathematical model of the system, they are prone to uncertainties, unforeseen disturbances, and computational burden as the system becomes more complex. Additionally, the model must be modified to account for any change in the PEDG. On the other hand, data-driven-based schemes can be used to perform effective detection and classification of wide range of anomalies such as FDIs in complex systems. As an example, artificial-neural-network-based approaches illustrated proper performance for nonlinear systems. These tools are an appealing candidate for anomaly detection system (ADS) and anomaly classification system (ACS) in PEDG. However, these schemes require huge datasets for training purposes in order to provide accurate performance. Other machine learning-based schemes such as k-nearest neighbor (k-NN), support vector machine (SVM) [22], [23], and deep learning [24] suffer from the same drawbacks and real-time implementation. As illustrated in [14] and [25], for power system applications, SVM illustrates better performance than k-NN, however, the performance of SVM highly depends on kernel type selection. In [26], a deeplearning-based method, which is modified version of WaveNet, was proposed and applied to IEEE 14-bus system while high penetration of renewable resources are considered. With all these methodologies, real-time implementation and scalability of the ADC and ACS are the remailing challenges.
Incorporating neural network (NN) based scheme, thus, has an opportunity to cooperate with control methods to ensure an impactful contribution. In this article, the inherent characteristics of model predictive control (MPC) is leveraged for effective real-time integration of NN-based network for realizing MADC in highly nonlinear PEDG. Conventional finite-set MPC determines optimal switching sequences based on the model and a cost function for optimization. The main focus of this article is to develop a framework for integration of MPC and NN for real-time MADC. The proposed work seeks to be a strong contender for scenarios in which the NN-based solutions do not significantly increase computational time compared to conventional MPC and where real-time detection of anomalies is of upmost importance. The work in [27] demonstrates an ability for MPC-based controllers to detect open circuit faults using the MPC cost function. This control scheme utilizes the main core of MPC to generate modified switching sequences constraint by the faulty switches without the need of major computation. The model used for generating the switching sequences is proven to be sufficient for open-circuit faults. However, for more comprehensive anomaly detection and classification, this article proposes an NN module integrated within the MPC framework. Therefore, a NN-based-detection scheme must provide additional utility which the conventional MPC itself cannot. The main technical challenge for NN integration with MPC for MADC is sufficient data collection for accurate classification in real-time.
Existing solutions mostly focus on detecting FDI attacks and they neglect the internal failure of the DERs [2]. Also, the existing literature, mostly focuses on detection only and they are not proposing any solutions after the detection is executed in real-time [2]. Additional utility is presented in classifying FDI attacks and circuit faults with a single NN. The main contribution of this article is the realization of a framework, which is able to detect and classify the anomalies across the PEDG in real-time. The proposed control scheme could be used at the primary layer of the control hierarchy of the PEDG to ensure detection and classification of anomalies of any nature, i.e., inverter internal failure or cyber-attack, in a real-time manner. Thus, integration of the proposed MADC in the primary control level at microseconds time scale results in smart self-learning inverters operating at the grid-edge toward resilient and secure PEDG. The considered attack model includes noise injection over the voltage and current measurements. The noise-based attacks are among the difficult-to-detect malicious activities, and their destructive impacts are considerable, varying from service interruptions to cascading failures across the grid. Specifically, the proposed control framework employs recurrent neutral networks (RNN). RNNs are utilized as feedforward NN techniques classification proved unable to determine fault classification [28]. Thus, for anomaly classification a deep NN topology is preferred. This category of neural networks are among the top candidates to perform classifications on time-dependent variables while taking into the account the previous inputs of the system [29]. Among different variants of RNNs, the long short-term memory (LSTM) employs an internal memory to create the predictions for next steps of the system [29], a perfect match to be integrated with MPC with long-time horizon prediction and optimization for the application in hand and real-time implementation. This internal memory with better predictive capabilities makes the LSTM the best option for fault classification within a system as complex as the PEDG. The initial part of the proposed framework employs LSTM in conjunction with MPC to perform anomaly detection and classification for inverters at the primary layer controller. The considered inverter topology in this article is cascaded multilevel inverted (CMI) due to its fault-tolerant capability [27], [30]. It is worth mentioning that the same approach could be employed for any other inverter architecture to reach to a similar performance. After detection and classification, the proposed LSTM-MPC framework adopts corrective actions to performs self-healing model predictive control to ensure fault-ride through capability in the case of internal failure of the inverter. The integrated LSTM-based MADC with self-healing MPC enhances the resiliency and cybersecurity of the PEDG in the case of inverter internal failure and noise-injection-based cyber intrusions. Thus, to put it in a nutshell, the major contributions of the article are as follows.
1) An integrated MPC-LSTM technique for detecting and classifying anomalies in real-time followed by a selfhealing solution and/or isolating the intruded DER in the network to ensure the resilient operation of the system by preventing cascading failure scenarios. 2) Comprehensive approach for data collection and training of LSTM for anomaly classification and effective mitigation in real-time, which is crucial for the application in hand.

3) Analysis and case studies to demonstrate the scalability of
proposed LSTM-MPC. 4) Discussion on the hyperparameter selection process as a guideline for design of LSTM. The rest of this article is organized as follows. Section II is a description of the PEDG system, LSTM, and MPC used. Section III details the collection of training data and the operation of the proposed LSTM-MPC. Section IV demonstrates the case studies. Finally, Section V concludes this article.

II. SYSTEM DESCRIPTION
The proposed LSTM-MPC detects anomalies and, with the guidance of the supervisory controller, determines whether the anomaly would allow for continued operation of the affected DER. If the anomaly presents a larger threat, it may ultimately lead to isolation from rest of the grid to ensure harmonious operation of other DERs and nearby nodes. While the proposed LSTM-MPC can be applied to any power system, the proposed scheme is tested primarily using a 14-Bus system with high penetration of DERs as the PEDG, and a seven-level cascaded multilevel inverter as power electronic interface of each DER. To detect an anomaly, the NN system receives input data at each sampling instance T s . This data is fed into the LSTM system, which is detecting for one of two potential anomalies considered in this article. Fig. 1 illustrate the schematic of the 14-Bus system with proposed LSTM-MPC.
Two classifications of anomaly are presented. The first detects whether a physical converter failure has occurred. In this article, it is an open circuit switch failure, a leading cause of semiconductor failure in power electronic systems [31]. This type of anomaly, once detected, allowing for continued operation. Thus, the supervisory controller can provide a corrective action to the MPC and continue operation. The second type of anomaly represents an FDI. This represents a potential cyber-attack on the current measurement sensors. When such a detection occurs, a DER can no longer be treated as a trusted source to the supervisory layer and, thus, must be isolated from the PEDG to prevent impact on nearby nodes and other healthy DERs. Therefore, corrective action is taken to prevent further attacks on the grid and ensure resilient operation.
The utility of the presented NN scheme is twofold. First, the NN scheme can detect potential anomalies in real-time. The goal of the NN detection scheme is to, in less than one line cycle, determine whether anomalous behavior exists and classify it as either a fault or cyber-attack; the unique contribution of this article. This quick detection allows for the supervisory layer to address anomalies before the impact is visible on the entire PEDG. The second feature of the NN approach is efficient use of computational resources. When the NNs are trained to reduce the computational burden, such as by having a single NN system detect numerous anomalies with the same input data, the local LSTM-MPC is operating efficiently. It also allows for further anomaly detection in future works where the single network approach can be used to classify more anomalies without extreme increase in the number of neurons. Thus, this two-level approach both on the local and supervisory level allows for discrete implementation. The proposed LSTM-MPC MADC framework is implemented on each phase of a CMI with the properties shown in Table I. A complete overview of the system implemented is seen in Fig. 1.

A. Communication Infrastructure of PEDG
The proposed control framework consists of MPC and NN parts working collaboratively to ensure short-term and long-term voltage and frequency stabilities of the PEDG. The MPC-based controller is utilized in the local controller. The local controller has the responsibility to receive the power set-points from the upper control layers, convert them to switching signals, and turn power electronic switches ON and OFF in the power stage accordingly. The reasons for opting MPC for the local controller include: easy to leverage into constrained multiobjective control problems, eliminating the hurdle of PID controller tuning for different operating points, better power quality, and proper for inner control loop with high compatibility with outer control loops. Considering these features, MPC is the best candidate for the local layer of the proposed controller. However, the local controller does not have proper knowledge of the entire PEDG, thus, the communication layer is required between the local layer of the controller and the supervisory layer.
The supervisory layer is responsible for overseeing the entire grid including generations, consumptions, reserved power, and power loss. Using all the gathered information, this layer assigned the power set-points for each individual inverter. Complete system under study for this work. The proposed neural network scheme exists as a per phase detection of the cascaded multilevel inverter at DER 4. This anomaly detection network is connected to the higher level 14-bus system at Bus 3. Anomalies are detected initially at the local controller, then verified at the supervisory level before corrective action is taken.
Various communication protocols are developed for smart grid applications for secure communications with minimal latency [32], [33], [34]. These protocols include, IEEE 802.15.4 (Zig-Bee), IEEE 802.11 (Wireless LAN (WLAN) or Wi-Fi), IEEE-802.16 (WiMAX), GSM and GPRS, and DASH7. But even with these improvements in communication protocols, the communication layer is the most vulnerable layer of the PEDG.
FDI attacks are possible attacks on the communication layer. In this article, the attacks considered are noise-based FDI attacks on the sensors measuring the current injected by the DERs. When there is communication between a supervisory controller and local controller, an attacker's plan can be to interfere with the communication layer and inject noise into the feedback loop or communication link of each individual inverter. In that case, although the supervisory layer has assigned specific set points to the MPC-based layer of the framework, the noise-based FDI attack prevents proper power injection when the measured current is incorrect. This means the balance between generation and consumption will deteriorate, and voltage or frequency stabilities of the system will be endangered. On the other hand, the supervisory layer of the PEDG needs an accurate model of the entire system to perform a load flow analysis to determine the voltage of each node and consequently determine the power setpoints for each individual inverter. Within the concept of PEDG, where the distributed resources and consumers are changing dynamically according to the time of the day and season, having a precise model of the system is almost impossible. This will paralyze the supervisory layer of the PEDG in the case of FDI attacks. For this reason, in the proposed control framework the supervisory layer of the controller is equipped with an NN-based algorithm. It performs the responsibilities of the supervisory layer without an accurate model of the entire integrated system. The proposed NN-based supervisory layer not only assigns the set points for each individual inverter, but also detects noise-based cyber intrusion. The proposed LSTM-MPC-based control framework enables the PEDG to differentiate between inverter internal failures and FDI attacks. This will enable the supervisory layer to take corrective actions using an MPC-based controller in the case of power stage failure of the inverter, or label the inverter as compromised in the case of FDI detection.

B. LSTM Description and Formulation
RNNs are a category of NNs, which analyze sequential data. Whereas more traditional methods, such as the feed forward neural network, produce outputs solely based on the current inputs to the NN. RNNs are trained to also incorporate past states of the network. These networks are strong contenders for anomaly classification, as instantaneous data may or may not be anomalous depending on where it occurs in a sequence. In this article, the LSTM RNN topology is used to enable the implementation of the LSTM cell, as shown in Fig. 2. The two activation functions used in each LSTM cell are the sigmoid and hyperbolic tangent functions, represented in Fig. 2 demonstrates each LSTM cell has 12 parameters determined through the training process. In this article, the structure of the LSTM network is constant; there is no variance in the number of features, LSTM layers, dropout rate, or classification layer. The major investigation for the training process is the number of hidden units in each LSTM layer. The training process accounting for changes in hidden states is detailed in Section III.

C. Model Predictive Control Formulation
The MPC applied for the CMI is shown in Fig. 1. This system is an adaptation of the finite-set MPC, which can eliminate switching sequences made impossible by an open circuit fault. This MPC scheme, as summarized in this section, is similar to the state-of-the-art approaches, with wide range of benefits for grid-tied inverter applications as highlighted in [35] and [36]. The proposed LSTM-MPC is focused on leveraging the inherent characteristics of state-of-the-art MPC with additional features. The MPC operates with a second order generalized integrator phase lock loop, which generates the grid angle needed for utilizing active and reactive power references, which are synchronized with the grid. The reference current i * k in (3) is determined from the active and reactive power references, and predicted current i k+1 in (4) is determined from using the forward Euler method The cost function (5) is determined using i * k and i k+1 where s is a specific switching state, and the array states lists, which of the switching sequences are permissible. Under normal operating conditions, states is a 1 × 64 array representing all valid switching states for a seven-level CMI. Whichever switching state minimizes the cost of (5) is applied to the inverter.

A. Data Collection
The LSTM-MPC is created by training data collected from the MPC system described in Section II-B. The diagram of the LSTM-MPC operational principle is shown in Fig. 3. The aim in data collection for this system is to ensure real-time detection is possible, and no additional measurements or sensors are necessary beyond those needed by conventional MPC. Additionally, proper simulation of the grid voltage during the collection of training data will allow for scalability of the LSTM-MPC into a wider range of power system topologies. If the system needs to be retrained for changing system properties such as the number of switches, power level, and voltage level the same process as described here can still be utilized. This eases the requirements for data collection and allows for more general usage of this system and training process. With this design principle in mind for collecting data, the data considered as input to the NN are 1 × 7 array INP given by where at sampling instant k, i [k] and i [k-1] are the inductor currents, V inv [k] and V inv [k-1] are the inverter voltages, OS [k] and OS [k-1] are the optimal switching states applied by the MPC, and V grid [k] is the grid voltage at the point of common coupling. The voltage and current measurements are the same as the measurements used in the MPC cost function formulation. The optimal states are the output of the MPC formulation and, thus, the switching states applied. Therefore, the variables chosen are impactful to detecting anomalies involving FDI and fault failures as it will impact the data of INP adversely and noticeably.  Table II. The final step triggers corrective action when the probability passes the trigger threshold, as explained in Section III.
The aim of the NN training process is to ensure proper network structure and training procedure, which can detect these anomalies in real-time and accurately. The DER as described in Section II and Table I is created in MATLAB/Simulink version 2021b to collect training data. The Simscape Specialized Power systems toolbox is utilized for solving power flow equations at each discrete step instance. The data creation is executed in this environment as it would also be used to verify the network operation in the case studies section. Thus, a comprehensive dataset is collected from a realistic PEDG bus as a true replica of DER in real world. In fact, this model can be considered as the digital twin of an actual physical system for collecting comprehensive data set for training purpose of NN network. Matching the training data accumulation to the method in which the system is tested and operated eliminates additional noise or unrealistic data, which might potentially skew the training process. These data are grouped into blocks 50 sample long to minimize the sample size needed for classification, leading to improved response time. Finally, data are randomly split into training, validation, and testing subsets, which are divided as 70%, 15%, and 15% of the total data acquired, respectively.
2) False Data Injection Data: Data collection for the FDI attack follows a similar setup as the open circuit fault data. To model an FDI attack, white noise is injected into the current sensor, which outputs normally distributed random noise. The noise has a power of 0.1. The attack occurs at 0.5 s, halfway through the data collection time of 1 s. To accumulate data for a wide range of situations, the amplitude of the noise and the power reference are varied. The output of the noise generator is multiplied by a constant N FDI , which varies from 0 to 2 in increments of 0.05. A total of 32 200 000 data points from this collection process are used for the FDI anomaly detection NN scheme. The data are grouped into blocks the same as the fault data.

1) Neural Network Topology:
With the training data collected, the next step is to describe the operation LSTM system. The fully trained MADC is able to determine when an anomaly is probable, which of the two classes the anomaly is in, and signals to the supervisory controller that corrective action is needed. The LSTM-MPC has three classes to represent the training data, "normal," "fault," and "cyberattack." Should different data be collected to train another LSTM-MPC, the number of classes will change to match the additional data and classifications. To create more balanced training data, half of the "normal" class of data from each data collection process is excluded from the training data set. The final data set classes are approximately 29.2% "fault," 37.4% "cyberattack," and 33.3% "normal." The goal of the LSTM-MPC is to have an accuracy above 90%. This data is sufficiently balanced to meet this goal since 90% accuracy requires high accuracy of each class and no individual class can dominate training. After detection, the supervisory controller can confirm the anomaly with a mirrored NN, should extra validation be required. Finally, corrective action is implemented.
2) Hyperparameters Selection: The LSTM network is trained in MATLAB 2021b. Determining the exact hyperparameters of the system, specifically the number of LSTM units in each of the two layers, is cause for further investigation to the specific control system. In this article, various hyperparameters are tested and examined to pick the most proper NN system for anomaly detection. Top priorities of operation in the 14-bus system are accuracy, detection speed, computational effort, and scalability. Accuracy is crucial for resilient operation of PEDG, fast detection speeds allow the MADC to take corrective action fast enough to prevent a violation of grid standards, low computational effort enables the anomaly detection network to run in parallel with the MPC, and scalability allows for deployment even in changing grid topology, perhaps due to more DERs coming online. Finally, a scalable system Therefore, the operation of the MPC will be used as a benchmark for the NN operation. The lower the execution rate, the better the NN system. While other hyperparameters such as batch size, learning rate, and activation function, may be considered necessary for other applications, the concerns of this article are primarily on execution rate of the scheme once the NN has been developed. Therefore, the hyperparameters adjusted are the number of neurons in each of the two layers of the LSTM.
Hyperparameter tuning is performed by adjusting the number of LSTM units in each layer. It is determined two layers are sufficient to correctly identify faults. In this article, the number of units will vary from 1 through 100 for the first layer, and the second layer will consist of either an equal number of units, or half (rounding up) the units of the first layer. The results of the hyperparameter tuning are seen in Table II. This table provides the hyperparameters of various LSTM networks along with the accuracy and computational effort required to execute each NN. Both the number of neurons and number of layers are seen in the leftmost column. For example, "10 × 5" denotes a two-layer network of 10 and 5 neurons, respectfully. The "anomaly detection accuracy" is the accuracy of the network using the testing data after five epochs of training. All other hyperparameters of the system remain constant, as described in Table III.
The computational rate is determined using the Performance Advisor Simulink Profiler in MATLAB/ Simulink. To account for variances in computational time due to hardware variance on the testing computers, the NN processing time is shown as a percentage of the processing time to enact the computations necessary for the MPC. For example, if the MPC required 100 s of total execution time in the profiler, and the NN system needed 75 s, the computational burden is considered 75%. This From the results generated in Table II, an optimal LSTM network is selected for implementation into the final system. The network selected is the least computationally expensive network with an accuracy of at least 90%. Thus, the 10 × 10 network is used; its accuracy is 96.66% with a computational burden of only 59.39%.

C. Corrective Action
After the LSTM-MPC has been trained, it is incorporated into the system as the "inverter neural network" shown in Fig. 1. During operation, the inputs to the LSTM-MPC are the data of INP at each sampling instance. The trained 10 × 10 LSTM-MPC produces a probability an anomaly has occurred. The three trained classification for the network are "normal," "fault," or "cyberattack." The LSTM-MPC produces a number from 0-1 for each class, where the higher the number is, the higher the probability the data is of the specified class. To prevent false positives from affecting an operational DER, the outputs of the fault detection network are fed into a moving average filter to filter out potential false positives and ensure a fault is only triggered when enough successive terms indicate high probability of a fault. Then, if the moving average filter exceeds a threshold V t , the anomaly fault flag is tripped, and the supervisory controller is notified. Before V t is exceeded for either "fault" or "cyberattack," the system is assumed to be "normal". For this article, V t = 0.16 for the fault detection and V t = 0.45 for the cyberattack detection. This threshold is manually set low enough to ensure fast response time, but high enough to prevent false positives. The threshold can be adjusted depending on the accuracy of the NN, as well as the desired response time of the system operator. After V t is exceeded, the supervisory controller confirms the anomaly and takes corrective action. Two corrective actions are implemented here: when an internal fault occurs, the corrective action detailed in [27] is executed, where states is updated to remove faulty switching states. If an FDI attack is determined, the bus is isolated and power references are adjusted, as explained in Section IV and (7).

IV. DISCUSSION AND VALIDATION
To verify the effectiveness of the proposed LSTM-MPC as an effective MADC, anomalies are intentionally created in Phase A of DER 4 of the 14-bus system. These can be either open circuit faults, or FDI attacks.

A. Fault Detection Verification
The first case study is to verify the LSTM-MPC can correctly identify a fault in both the positive and negative voltage levels of Phase A. In this article, P ref is 16 kW and Q ref is 0 kW. A fault occurs at t = 2 s for each test. In test one, the fault occurs in switch S 1 and in the second test the fault occurs in switch S 2 . When the output of the moving average filter exceeds V t the updated states matrix is applied preventing any faulty switch from being utilized in the "closed" state. The results of each test are seen in Fig. 4. When S 1 fails, the fault is detected and corrected in 14.32 ms; when S 2 fails, the fault is detected and corrected in 4.08 ms. As seen in each example, the proposed LSTM-MPC scheme can quickly identify faults in less than one line cycle. This allows quick identification for each fault and prevents the need to isolate the faulty DER due to inferior current quality for grid standards, thus providing real-time solution at the grid-edge.

B. Impact of Compromised DER Isolation
To demonstrate the added benefit of the open circuit fault detection network, the second case study compares the proposed network to a system without any fault detection. In this case study, DER 4 is considered a major contributor to power generation in the 14-bus system. The P ref is increased to 20 kW, the 14-bus system is operated during low loading conditions, and the synchronous generator has a maximum capacity of 100 kW. For simplicity, all other DER generators remain constant. Therefore, failure of DER 4 will lead to an inability to supply power across the system as the synchronous generator is unable to provide the needed power and frequency support. In this case study the open circuit fault occurs in switch S 1 at 2 s. Fig. 5(a) shows the LSTM-MPC system operating to take corrective action to ensure proper operation despite the fault. Fig. 5(b) shows the alternative, where the open circuit fault occurs at 2 s. After five-line cycles, DER 4 must isolate from the 14-bus network due to unacceptable power quality. Thus, the power injected by The low power quality after the fault forces DER 4 to isolate from the 14-bus after five line cycles. Since the synchronous generator is unable to compensate, the system frequency collapses. Fig. 6. Results of the third case study. Here, the robustness of the NN during FDI is shown, as changes in the power reference do not cause. When FDI does occur, the system responds promptly by alerting the supervisory controller, which is then able to isolate the attacked DER from the system to minimize the effects on the rest of the system. the DER becomes zero. With the synchronous generator unable to provide the necessary power to regulate frequency, it rapidly denigrates and the frequency of the entire system collapses. Therefore, the LSTM-MPC scheme ensures the DER does not cause system collapse even when an open circuit fault occurs in a critical DER.

C. Changing Power Reference in Response to Anomalies
The case study here demonstrates the LSTM-MPC scheme's ability to detect an FDI attack, as well as the system robustness to changing P ref values. A change in P ref can represent an anticipated load increase, change in solar irradiance if the DER is a PV system, or any other ramp increase in power generation. In this article, the system operates under the same initial conditions presented in Section VI-B. At t = 2 s, the P ref for DER 4 ramps up at a rate of 5000 kW/s. At t = 3 s, P ref ceases to increase. Once this state is reached, an FDI attack occurs on the current sensor when t = 3.25 s. The results of this case study are shown in Fig. 6. As depicted, the proposed LSTM-MPC scheme operates

D. Impact of the LSTM-MPC on the System Resiliency
The fourth case study investigates the effect of isolating a DER under attack. In this scenario, a FDI attack occurs at DER 4 at t = 4.5 s, injecting noise into the current sensor. The increased harmonics caused by the noise injection and the reduced power quality of the DER causes breakers to trip, isolating the DER from the grid. The scenario is tested under two conditions, with and without the LSTM-MPC scheme. Without the LSTM-MPC, the supervisory layer is not alerted to the anomaly and mismatch occurs between the power generation and demand. With the proposed LSTM-MPC, the anomaly is properly identified and verified by the supervisory controller 12.0 ms after the attack. The corrective action in this scenario accounts for the removal of DER 4 and its power contributions are evenly divided amongst the remaining DERs using where P ref,n is the power reference for DER n, P * ref,n is the power reference of DER n before the attack, and P avalible is the power generated by the safe DERs before the attack. Another approach can replace (7) should it be desired by the supervisory controller. The results of the system under both scenarios are recorded in Table IV and Fig. 7. Table IV displays the voltage at each bus before the attack, as well at the voltage at 5 s. With the LSTM-MPC and corrective action taken, the average voltage deviation is 0.7% the p.u. voltage before the fault, compared to an average deviation of 2.2% without the corrective action. Additionally, with the corrective action, all buses are >0.9 V p.u., whereas buses 1 and 2 do not meet this criterion without the LSTM-MPC network.

E. Scalability Analysis
The previous case studies incorporate the LSTM-MPC to a DER connected to an IEEE 14-bus system. The DER is rated for a grid voltage of 220 V and 60 Hz, as per the parameters in With anomaly detection and corrective action. After isolation from the system, the system with the NN scheme has a smaller impact on the bus voltage due to the corrective action taken by the supervisory controller after the fault.  Table I. These parameters accurately describe the low voltage operation of the 14-bus system. This match allows for easy implementation of the LSTM-MPC in DER 4 at Bus 3. This implies the LSTM-MPC is properly trained to operate in any power system topology; with the important assumption that the bus the LSTM-MPC is connected to is accurately reflected in the training data. Changing the topology of the system should not prevent the LSTM-MPC from operating properly.
To verify this assumption, the 14-bus system is expanded to 18 buses in this case study. The LSTM-MPC is tested in conditions where the DER matches Case Study 1. Two anomaly scenarios are tested. First, a switch failure in S 1 occurs at 3.5 s, and second, an FDI attack occurs in the current sensor of Phase A at 3.5 s. The results of these tests are seen in Fig. 8. Similar to the case studies involving the original 14 bus system, the LSTM-MPC is capable of detecting both anomalies in less than one line cycle. The fault is mitigated after 11.10 ms and the FDI after 11.26 ms. These results support the premise that the topology of the power system is of little impact to the well trained LSTM-MPC. If the DER is connected to a bus where training data is collected with appropriately, the system can be scaled easily to detect these anomalies locally.

V. CONCLUSION
This article presents an anomaly detection and correction scheme for PEDG. The proposed MADC and corrective action is based on an integration of LSTM and MPC, which features real-time solutions for enhancing the resiliency of PEDG when anomalies occurs. In the proposed scheme, when an anomaly is detected, the supervisory layer controller can implement corrective action to ensure the power system continues proper operation. The data collection technique and training process of the long short-term memory network is described as well as the methodology of selecting proper hyperparameters. The training data is selected to increase scalability of the LSTM-MPC should the network topology expand as more DERs are integrated into the PEDG. An optimal LSTM network is used to test and validate the operation of the network. The case studies verify the system ability to allow robust deployment after anomalies occur, and the impact of the corrective actions by the supervisory controller is demonstrated.

ACKNOWLEDGMENT
The statements made herein are solely the responsibility of the authors.