[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-143462-105":59,"doc-detail-143462-en":130},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":123,"head_meta":125,"extra_data":127,"updated_unix":129},105,"en","watching-grid-infrastructure-stealthily-through-proxies-wisp-energy-market-monitoring-and-cyberattack-detection","Watching Grid Infrastructure Stealthily Through Proxies (WISP) - Energy Market Monitoring and Cyberattack Detection","","Locational marginal pricing (LMP) mechanisms are used to derive real-time insights into power grid operations, constraints, and regional pricing behavior. WISP researches and develops an open-source, non-intrusive monitoring tool that uses publicly available real-time prices plus bids, weather, and power outage data to detect and distinguish cyberattacks from normal power system events. The approach builds LMP-based signatures, feeds machine learning for optimal detection thresholds, and supports alerting and operator mitigation.",{"@graph":69,"@context":122},[70,84,105],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/watching-grid-infrastructure-stealthily-through-proxies-wisp-energy-market-monitoring-and-cyberattack-detection/143462/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/watching-grid-infrastructure-stealthily-through-proxies-wisp-energy-market-monitoring-and-cyberattack-detection/143462.png","ImageObject",300,407,{"name":92,"@type":93},"Sage","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-30","2026-08-25",true,{"@type":102,"interactionType":103,"userInteractionCount":52},"InteractionCounter",{"@type":104},"ViewAction",{"@type":106,"mainEntity":107},"FAQPage",[108,114,118],{"name":109,"@type":110,"acceptedAnswer":111},"How does WISP detect cyberattacks in energy management systems?","Question",{"text":112,"@type":113},"WISP analyzes real-time LMP and other public information such as bids, weather, and outage data. It correlates pricing behaviors to regions of interest and uses LMP-based signatures with machine learning to distinguish malicious manipulation from normal events.","Answer",{"name":115,"@type":110,"acceptedAnswer":116},"What makes WISP non-intrusive and suitable for monitoring?",{"text":117,"@type":113},"WISP relies on publicly available, real-time pricing mechanisms and other non-intrusive data streams. This design supports continuous monitoring without disrupting critical energy delivery functions.",{"name":119,"@type":110,"acceptedAnswer":120},"What outcomes does the project deliver for utilities and grid operators?",{"text":121,"@type":113},"WISP provides an open-source attack detection and energy market monitoring platform that can be deployed by utilities, regional transmission organizations, and independent system operators. It enhances cybersecurity and resiliency across market, control, and grid layers while minimizing system losses through informed detection thresholds.","https://schema.org",{"og:url":83,"og:type":124,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":126,"canonical":83},"index,follow",{"doc_id":128,"site_id":62},143462,1787695256,{"code":4,"msg":5,"data":131},{"doc_id":128,"user_id":132,"nickname":92,"user_avatar":133,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":52,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":14,"language":139,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":140,"faqs":141,"seo_title":142,"seo_description":67,"update_tm":129,"read_time":24},687197207057,"https://ap-avatar.wpscdn.com/davatar_29158cc5080c5b710cf443261637dec0","Watching Grid Infrastructure Stealthily Through Proxies (WISP)  \nUsing publicly available, realtime pricing mechanisms against cyberattacks  \nLocational marginal pricing (LMP) mechanisms provide critical insights into power grid operations. They assess various operating characteristics and constraints on transmission capabilities to dynamically determine regional pricing information. LMP inputs may also serve as indicators of anomalous events and cyberattacks. This project is researching and developing an open-source, non-intrusive, energy market monitoring tool that uses publicly available information to detect and distinguish cyberattacks from normal power system events. WISP uses real-time LMP and other publicly available information, such as bids, weather, and power outage data, to analyze power pricing behaviors and then correlates those observations to localized regions of interest, identifying potential cyber events. The tool will use a library of LMP-based signatures to feed a machine learning algorithm and inform its monitoring processes and optimal detection thresholds to minimize system losses.  \nKEY TAKEAWAYS  \n• Detects, mitigates, and alerts operators of malicious information injection into energy management systems  \n• Develops machine learning algorithms that use electricity market data streams and system conditions to detect the effects of malicious manipulation  \n• Uses publicly available real-time prices to detect and distinguish cyberattacks from normal power system events  \nOUTCOME  \nWISP is an open-source, advanced attack detection and energy market monitoring platform deployable for utilities and regional transmission organizations and independent system operators. This technology builds and informs models by harnessing advanced analytics from various data streams from the electricity market, social media, and weather agents, to detect cyber events localized to regions of interest. WISP transparently augments cybersecurity and resiliency to the market, control, and the grid layers without impeding critical energy delivery functions.  \nPARTICIPANTS ROLE  \n\n| | Conducts technical design, development, validation, and\u003Cbr>commercialization activities; studies spatial and temporal\u003Cbr>signatures and sensitivities of locational marginal prices;\u003Cbr>designs and develops anomaly detection module |\n| --- | --- |\n| | Performs system vulnerability analysis, identifies high cyber risk time periods and locations, and assists in technology demonstration |\n| | Serves as an energy sector advisor for research, demonstration, and commercialization activities |\n| | Provides subject matter expertise and assists in anomaly root cause analysis for identifying regions of interest |\n\nCONTACT INFORMATION  \nInitial Leads:  \nCarol Hawk  \nProgram Manager  \nLingyu Ren  \nPrincipal Investigator  \nRaytheon Technologies Research Center 860-610-7705  \n[lingyu.ren@rtx.com](lingyu.ren@rtx.com)  \nPeriod of Performance: October 2018 – November 2021  \nTotal Award Value: $2,813,666  \nDOE Share: $2,011,098  \nCost Share: $802,568  \nCurrent Contact as of February 2020:  \nAkhlesh Kaushiva  \nSenior Technical Systems and Cybersecurity Advisor Department of Energy (DOE)  \nOffice of Cybersecurity, Energy Security, and Emergency Response (CESER) 202-287-6062  \n[Akhlesh.Kaushiva@hq.doe.gov](Akhlesh.Kaushiva@hq.doe.gov)  \nCYBERSECURITY FOR ENERGY DELIVERY SYSTEMS (CEDS)  \nCEDS projects are funded through DOE CESER, which aims to enhance the reliability and resilience of the nation’s energy infrastructure by reducing the risk of energy disruptions due to cyberattacks.  \nWebsite: [https://www.energy.gov/ceser](https://www.energy.gov/ceser)  \nDate Written: June 2021","cbCaiuSKWbNX9vgb","https://ap.wps.com/l/cbCaiuSKWbNX9vgb","pdf",536935,"English","# Project Overview\n## Core Approach and Data Sources\n# Key Takeaways\n# Outcome and Deployment\n## Target Users and Use Cases\n# Participants and Roles\n## Technical Development and Validation\n## Vulnerability and Advisory Support\n# Contact Information\n## Leads and Period of Performance\n## DOE Program Context","[{\"question\":\"How does WISP detect cyberattacks in energy management systems?\",\"answer\":\"WISP analyzes real-time LMP and other public information such as bids, weather, and outage data. It correlates pricing behaviors to regions of interest and uses LMP-based signatures with machine learning to distinguish malicious manipulation from normal events.\"},{\"question\":\"What makes WISP non-intrusive and suitable for monitoring?\",\"answer\":\"WISP relies on publicly available, real-time pricing mechanisms and other non-intrusive data streams. This design supports continuous monitoring without disrupting critical energy delivery functions.\"},{\"question\":\"What outcomes does the project deliver for utilities and grid operators?\",\"answer\":\"WISP provides an open-source attack detection and energy market monitoring platform that can be deployed by utilities, regional transmission organizations, and independent system operators. It enhances cybersecurity and resiliency across market, control, and grid layers while minimizing system losses through informed detection thresholds.\"}]","Watching Grid Infrastructure Stealthily Through Proxies (WISP) - Energy Market Monitoring and Cyberattack Detection | PDF"]