Search

Conventional cyber-security intrusion detection systems monitor network traffic for malicious activity and indications that an adversary has gained access to the system. The approach discussed here expands the idea of a traditional intrusion detection system within electrical power systems, specifically power distribution networks, by monitoring the physical behavior of the grid. This is achieved through the use of high-rate distribution Phasor Measurement Units (PMUs), alongside SCADA packets analysis, for the purpose of monitoring the behavior of discrete control devices. In this work we present a set of algorithms for passively learning the control logic of voltage regulators and switched capacitor banks. Upon detection of an abnormal operation, the operator is alerted and further action can be taken. The proposed learning algorithms are validated on both simulated data and on measured PMU data from a utility pilot deployment site.

Due to the potentially severe consequences of coordinated cyber-physical attacks (CCPA), the design of defenses has gained significant attention. A popular approach is to eliminate the existence of attacks by either securing existing sensors or deploying secured PMUs. In this work, we improve this approach by lowering the defense target from eliminating attacks to preventing outages and reducing the required number of PMUs. To this end, we formulate the problem of PMU Placement for Outage Prevention (PPOP) under DC power flow model as a tri-level non-linear optimization problem and transform it into a bi-level mixed-integer linear programming (MILP) problem. Then, we propose an alternating optimization framework to solve PPOP by iteratively adding constraints, for which we develop two constraint generation algorithms. In addition, for large-scale grids, we propose a polynomial-time heuristic algorithm to obtain suboptimal solutions. Next, we extend our solution to achieve the defense goal under AC power flow model. Finally, we evaluate our algorithm on IEEE 30-bus, 57-bus, 118-bus, and 300-bus systems, which demonstrates the potential of the proposed approach in greatly reducing the required number of PMUs. [ABSTRACT FROM AUTHOR]

With the increasing risks of malicious cyber-physical attacks and natural disasters, it is urged for power grids to improve the resilience performance against such high-impact, low-frequency events. The critical component identification is an important problem for the effective planning, operation and asset management of power systems. Thus, it is highly necessary and beneficial to develop a resilience oriented critical component identification method for defending power systems against extreme events. In this paper, a tri-level optimization model is developed to identify the critical components while the coordinated cyber-physical attacks on power systems are formulated considering the resources of attackers, the optimal attack strategy, and the actions of the system operator to enhance the system resilience against potential attacks. Meanwhile, a distributionally robust optimization (DRO) based model is proposed to consider the impacts of distribution uncertainty of the resource or ability of the malicious attackers in the criticality identification framework. A constraint-generation based algorithm is developed to solve the overall multi-level DRO model with a master and sub-problem scheme. Further, a criticality index is proposed to quantify the importance of key components to the system resilience against malicious cyber-physical attacks. In order to validate the proposed method, case studies were conducted on the IEEE reliability test system (RTS-79). The obtained results show that the proposed critical component identification method can provide effective and robust importance evaluation of system components to bolster the grid resilience against potential cyber-physical threats. [ABSTRACT FROM AUTHOR]

False data injection attacks (FDIA) are a main category of cyber-attacks threatening the security of power systems. Contrary to the detection of these attacks, less attention has been paid to identifying the attacked units of the grid. To this end, this work jointly studies detecting and localizing the stealth FDIA in power grids. Exploiting the inherent graph topology of power systems as well as the spatial correlations of measurement data, this paper proposes an approach based on the graph neural network (GNN) to identify the presence and location of the FDIA. The proposed approach leverages the auto-regressive moving average (ARMA) type graph filters (GFs) which can better adapt to sharp changes in the spectral domain due to their rational type filter composition compared to the polynomial type GFs such as Chebyshev. To the best of our knowledge, this is the first work based on GNN that automatically detects and localizes FDIA in power systems. Extensive simulations and visualizations show that the proposed approach outperforms the available methods in both detection and localization of FDIA for different IEEE test systems. Thus, the targeted areas can be identified and preventive actions can be taken before the attack impacts the grid. [ABSTRACT FROM AUTHOR]

With the advent of the advanced metering infrastructure, electricity usage data is being continuously generated at large volumes by smart meters vastly deployed across the modern power grid. Electric power utility companies and third party entities such as smart home management solution providers gain significant insights into these datasets via machine learning (ML) models. These are then utilized to perform active/passive power demand management that fosters economical and sustainable electricity usage. Although ML models are powerful, these remain vulnerable to adversarial attacks. A novel stealthy black-box attack construction model is proposed that targets deep learning models utilized to perform non-intrusive load monitoring based on smart meter data. These attacks are practical as there is no assumption of the knowledge of training data, internal parameters, and architecture of the targeted ML model. The profound impact of the proposed stealthy attack constructions on energy analytics and decision-making processes is shown through comprehensive theoretical, practical, and comparative analysis. This work sheds light on vulnerabilities of ML models in the smart grid context and provides valuable insights for securely accommodating increasing prevalence of artificial intelligence in the modern power grid. [ABSTRACT FROM AUTHOR]

The availability of high-fidelity energy networks brings significant value to academic and commercial research. However, such releases also raise fundamental concerns related to privacy and security as they can reveal sensitive commercial information and expose system vulnerabilities. This paper investigates how to release the data for power networks where the parameters of transmission lines and transformers are obfuscated. It does so by using the framework of Differential Privacy (DP), that provides strong privacy guarantees and has attracted significant attention in recent years. Unfortunately, simple DP mechanisms often result in AC-infeasible networks. To address these concerns, this paper presents a novel differentially private mechanism that guarantees AC-feasibility and largely preserves the fidelity of the obfuscated power network. Experimental results also show that the obfuscation significantly reduces the potential damage of an attack carried by exploiting the released dataset. [ABSTRACT FROM AUTHOR]

Microgrids (MGs) rely on networked control supported by off-the-shelf wireless communications. This makes them vulnerable to denial-of-service (DoS) attacks. In this paper, we mitigate those attacks by: 1) separating data plane from network control plane, inspired by the software defined networking paradigm and 2) performing control plane exchanges over the power bus, thus allowing for an agile reconfiguration of the data plane connections. Specifically, in the proposed architecture, all generators in the MG operate as either voltage regulators (active agents), or current sources (passive agents), with their operating mode being determined by software-defined MG control supported by the control plane communication performed over the power bus. For the purpose of control plane communication, we adopt power talk, a modem-less, low-rate, and power-line communication solution designed for direct current MGs. The results show that the proposed software-defined MG offers superior performance compared to the static MG, as well as resilience against DoS attacks. [ABSTRACT FROM AUTHOR]

Developing efficient strategies for defending electric power systems against attacks is a major concern for contemporary power grids, especially when uncertainties are involved. This paper addresses the allocation of the defensive resource to minimize the damage when there are uncertainties regarding the resource that the attacker has. A multiple-attack-scenario (MAS) defender–attacker–defender (DAD) model is proposed by extending the conventional trilevel DAD model. The proposed model considers the uncertainties related to the offensive resource and the interactions involving the security personnel at the top-level, the attacker at the middle-level, and the power system operator at the bottom-level. The column-and-constraint generation algorithm is implemented by decomposing the MAS DAD model into an upper-level problem for the security personnel, and a lower-level problem for the attacker involving the optimal power flow analysis-based corrective power redispatch implemented by the power system operator. Case studies are performed based on the IEEE RTS79 and 57-bus systems, and the results validate that the proposed method is able to minimize the damage when uncertainties are involved in the offensive resource. This paper can offer meaningful insights into power system protection involving uncertainties. [ABSTRACT FROM AUTHOR]

The continuing rollout of phasor measurement units enables wide area monitoring and control (WAMS/WACS), but the difficulty of sharing data in a secure, scalable, cost-effective, low-latency manner limits exploitation of this new capability by bulk electric power grid operators. GridCloud is an open-source platform for real-time data acquisition and sharing across the jurisdictions that control a bulk interconnected grid. It leverages commercial cloud tools to reduce costs, employing cryptographic methods to protect sensitive data, and software-mediated redundancy to overcome failures. The system has been tested by ISO New England and the results reported here demonstrate a level of responsiveness, availability, and security easily adequate for regional WAMS/WACS, with the capacity for nation-wide scalability in the future. [ABSTRACT FROM AUTHOR]

Given the strong cyber-physical coupling that exists in power systems today and of the future, false data injection (FDI) attacks have been shown to be feasible in tampering measurement devices by exploiting cyber vulnerabilities to mislead state estimation and related applications. For example, a corrupt generator owner, motivated by financial gain, may manipulate meter readings associated with short-term load forecasts and subsequently misguide the decisions of security constrained economic dispatch (SCED) in ex-ante real-time markets. In this paper, we analyze the feasibility of financially motivated FDI attacks in bi-level programming settings where multi-solution uncertainty of SCED is considered. To deter such attacks, a robust incentive-reduction strategy is proposed that can prevent financially motivated FDI attacks for all the possible load distributions and solutions of SCED requiring a minimal number of protected meters. Simulations for the IEEE 14-bus and IEEE 30-bus test systems demonstrate attack feasibility and performance of the proposed mitigation strategy for SCED in real-time markets. [ABSTRACT FROM AUTHOR]

Game theory has recently been applied for analyzing the security of power systems under intelligent attack threats. This letter presents a linear game framework for optimal allocation of a defense budget to confront intelligent attacks on power systems. The presented framework offers the advantage that it can be applied in large power systems with a large number of components under attack threat without too much complexity. The presented linear framework is successfully applied on test systems. [ABSTRACT FROM AUTHOR]

The real-time electrical market operations in smart grid require reliable and accurate data from state estimation. However, state estimation is vulnerable to data integrity attacks, in which strategically manipulated meter measurements can bypass the conventional bad data detection and introduce errors. As a result, it becomes more likely for the attackers to control real-time electrical market through manipulations of meter measurements. In this paper, we first reveal the intrinsic relations between data integrity attacks and real-time electrical market operations, and explicitly characterize their complex interactions as a process simulator. Then a simulation-based global optimization problem is formulated from which attackers could maximize financial incentives through constructed data integrity attacks. More importantly, a novel systematic online attack construction strategy is proposed, such that attackers can launch the desired attacks only by the real-time data streams of meter measurements and no power network topology or parameter information is needed. A corresponding online defense strategy is also presented to detect and identify the malicious measurements without extra meter hardware investments. Finally, we evaluate the performance of the proposed attacking strategies and countermeasure through numerical simulations in IEEE test systems with both synthetic and real data from the New York Independent System Operator. [ABSTRACT FROM PUBLISHER]

With increasing deployments of smart grid systems, a large quantity of energy usage and grid status data have been collected by smart grid devices like smart meters. To secure these critical and sensitive data, it is crucial to prevent unauthorized readings from these devices. Many authentication protocols have been proposed to control access to smart grid devices that are a part of the smart grid data communication network; however, authentication protocols to control readings from the isolated smart grid devices are mostly ignored. In this paper, we propose a secure and efficient framework to enable secure data readings from the isolated smart grid devices based on a two-phase authentication protocol. The framework not only makes use of the smart reader as a bridge to connect the isolated smart grid device and the smart grid cloud, but also considers the physical constraints of all the devices in the system. Security analysis shows that our framework is efficient and secure under most typical attacks, meanwhile it satisfies the hardware constraints of smart grid devices. Comprehensive performance evaluation also validates the efficiency of the proposed framework. [ABSTRACT FROM PUBLISHER]

Smart grid addresses the problem of existing power grid’s increasing complexity, growing demand, and requirement for greater reliability through two-way communication and automated residential load control among others. These features also make the smart grid a target for a number of cyber attacks. In this paper, we study the problem of price modification attack (PMA) through fabrication of price messages, which induces changes in load profiles of individual users and eventually causes major alteration in the load profile of the entire network. Combining with cascading failure, it ends up with a highly damaging attack. We prove that the problem is nondeterministic polynomial-time-complete and provide its inapproximability. We devise two approaches for the problem, the former deals with maximizing failure of lines with the given resource and then extending the effect with cascading failure, while the later takes cascading potential into account while choosing the lines to fail. We formulate new protection strategy against PMA and this includes two new algorithms, namely bi-level programming with new branching method and an effective heuristic to improve the running time. Empirical results on both IEEE bus data and real network help us evaluate our approaches under various settings of grid parameters. [ABSTRACT FROM PUBLISHER]

Power systems are generating masses of data, including measurement and simulation data. To operate and control power systems more effectively, this paper establishes a distributed platform to store, read, and compute massive amounts of data. Our distributed computing platform can support online simulation based power system security knowledge discovery through big data analysis. First, a framework for a distributed computing platform is designed. Then, distributed algorithms are developed, including a distributed massive sampling simulation method and a distributed feature selection method. Next, the software platform and hardware platform for the distributed computing platform are established. Finally, the platform is applied to the Guangdong Province Power System in China to evaluate its accuracy and efficiency. The simulation results show that the distributed computing platform can improve computing efficiency and perform better than a centralized platform. [ABSTRACT FROM PUBLISHER]

Information and communication infrastructure will be extensively deployed to monitor and control electric power delivery components of today’s power grid. While these cyber elements enhance a utility’s ability to maintain physical stability, if a subset are compromised by adversaries, disruption may occur. In this paper, a novel framework based on the principles of differential games is proposed that demonstrates stealthy worst-case strategies for attackers to disrupt transient stability by leveraging control over distributed energy resources. We demonstrate that if the electric power utility is able to identify uncompromised components, countermeasures can exist that effectively reduce the impact of attack for a fixed time interval. Based on our results, we develop insights to construct safety margin recommendations for cyber-physical smart grid actuation elements that promote system resilience during a cyber attack. [ABSTRACT FROM PUBLISHER]

Synchrophasor systems provide an immense volume of data for wide area monitoring and control of power systems to meet the increasing demand of reliable energy. The construction of traditional intrusion detection systems (IDSs) that use manually created rules based upon expert knowledge is knowledge-intensive and is not suitable in the context of this big data problem. This paper presents a systematic and automated approach to build a hybrid IDS that learns temporal state-based specifications for power system scenarios including disturbances, normal control operations, and cyber-attacks. A data mining technique called common path mining is used to automatically and accurately learn patterns for scenarios from a fusion of synchrophasor measurement data, and power system audit logs. As a proof of concept, an IDS prototype was implemented and validated. The IDS prototype accurately classifies disturbances, normal control operations, and cyber-attacks for the distance protection scheme for a two-line three-bus power transmission system. [ABSTRACT FROM PUBLISHER]

We consider the sequential (i.e., online) detection of false data injection attacks in smart grid, which aims to manipulate the state estimation procedure by injecting malicious data to the monitoring meters. The unknown parameters in the system, namely the state vector, injected malicious data and the set of attacked meters pose a significant challenge for designing a robust, computationally efficient, and high-performance detector. We propose a sequential detector based on the generalized likelihood ratio to address this challenge. Specifically, the proposed detector is designed to be robust to a variety of attacking strategies, and load situations in the power system, and its computational complexity linearly scales with the number of meters. Moreover, it considerably outperforms the existing first-order cumulative sum detector in terms of the average detection delay and robustness to various attacking strategies. For wide-area monitoring in smart grid, we further develop a distributed sequential detector using an adaptive sampling technique called level-triggered sampling. The resulting distributed detector features single bit per sample in terms of the communication overhead, while preserving the high performance of the proposed centralized detector. [ABSTRACT FROM PUBLISHER]

Recent investigations have revealed the susceptibility of phasor measurement units (PMUs) to the time synchronization attack by spoofing its global positioning system (GPS). This paper proposes a cross-layer detection mechanism to fight against simultaneous attacks toward multiple PMUs. In the physical layer, we propose a GPS carrier-to-noise ratio (C/No) based spoofing detection technique. We apply the patch-monopole hybrid antenna to two GPS receivers and compute the difference between the standard deviation of each receiver’s C/No. The priori probability of spoofing is calculated from the distributions of the difference. A counter is embedded in the physical layer to identify the most suspicious PMU. In the upper layer, the spoofing attack is considered similarly to the bad data injection toward the power system. A trustworthiness evaluation, which is based on both the physical layer information and power grid measurements, is applied to identify the PMU being attacked. An experiment has been carried to validate the proposed algorithm. [ABSTRACT FROM PUBLISHER]

Distributed generators (DGs) are being widely deployed in today’s power grid. These energy sources are highly variable posing practical challenges for deployment and grid management. In this paper, a novel scalable distributed power dispatch strategy is proposed to effectively manage DGs at the distribution substation level, capitalizing on the recent push to cyber-enable power grid operations. We demonstrate how the inherent separability of the power dispatch problem allows the use of dual decomposition that enables every participating DG to locally compute its dispatch strategy based on simple broadcast data by the utility. Results and comparisons indicate that the DGs are able to rapidly converge to an optimal economical dispatch vector with significantly less concentrated computational effort and communication overhead, promoting security and privacy. [ABSTRACT FROM PUBLISHER]

Generation connected to electrical distribution systems requires reliable and timely detection of loss-of-mains (islanding). Passive loss-of-mains detection relays typically use measurements of parameters such as frequency, phase, and the magnitudes of voltage and current. If a part of the power network becomes islanded and there is a very close match between generation and demand of both active and reactive power, there is a risk that the relay will not be able to detect the loss-of-mains (LOM) event quickly, or perhaps at all. This is the “non-detection zone” or NDZ. This paper proposes a combination of 2 generator control techniques which allow the NDZ to be avoided even when the generator has significant inertia. Firstly, the natural instability (when islanded) of a grid-connected control scheme consisting of integral and droop controls is recognized and exploited. Secondly, a simple strategy is added which makes occasional small, steady-state adjustments to the reactive power output of the generator. The scheme has been tested in the laboratory and shows that the 2 second detection time required by IEEE 1547 can be achieved, even when an exact match of active power generation and demand is initially configured, and the generator has a significant inertia. [ABSTRACT FROM PUBLISHER]

Recent years have seen increased interest in the design and deployment of smart grid devices and control algorithms. Each of these smart communicating devices represents a potential access point for an intruder spurring research into intruder prevention and detection. However, no security measures are complete, and intruding attackers will compromise smart grid devices leading to the attacker and the system operator interacting via the grid and its control systems. The outcome of these machine-mediated human-human interactions will depend on the design of the physical and control systems mediating the interactions. If these outcomes can be predicted via simulation, they can be used as a tool for designing attack-resilient grids and control systems. However, accurate predictions require good models of not just the physical and control systems, but also of the human decision making. In this manuscript, we present an approach to develop such tools, i.e., models of the decisions of the cyber-physical intruder who is attacking the systems and the system operator who is defending it, and demonstrate its usefulness for design. [ABSTRACT FROM PUBLISHER]

Modern smart grids, by and large, merge physical interconnections and cyber controllers. Invariably, this tight coupling results in cyber commands manifesting in the physical layer as observable changes, leading to possible disclosure of sensitive system settings. Thus, cyber event confidentiality of the smart grid is violated. Attacks on confidentiality can ultimately lead to integrity and availability attacks; with adequate knowledge of the system topology, internal settings, and how the physical layer responds to cyber commands, a malicious adversary gains knowledge to attack the system. This work shows how to develop self-obfuscating systems based on information flow security properties that can mitigate event confidentiality violations in smart grids. [ABSTRACT FROM PUBLISHER]

The anticipated proliferation of cyber components for collecting information and controlling operations of smart grids increases their vulnerability to a variety of cyber attacks. For instance, a large-scale simultaneous attack on smart meters to destabilize the grid could be feasible via cyber means, which is not viable via physical attacks alone. The interactions between the providers and attackers of the smart grid and their optimal strategies can be modeled as a Markov game. However, the computational complexity of such a game grows exponentially with the size of the infrastructure, making it impractical for smart grids of reasonable sizes. In this paper, we show that when the players' current interest is a subset of the states only and they are willing to accept small inaccuracies in the game solutions, many Markov game states can be pruned. We present a pruning algorithm in which a threshold parameter is used to control qualitatively the tradeoff between computation time and solution accuracy. The algorithm is iterative with decoupled state values in each iteration, and we parallelize the state estimations to reduce the overall computation time. We illustrate with examples that the pruning algorithm reduces the computation time greatly without losing much precision in the game solutions, and that parallelization further reduces the computation time. [ABSTRACT FROM PUBLISHER]

To mitigate the threat of malware intrusions on networked embedded systems, it is desirable to provide remote attestation assurances for them. Embedded systems have special limitations concerning cost, power efficiency, computation, and memory that influence how this goal can be achieved. Moreover, many types of applications require integrity guarantees for the system over an interval of time rather than just at a given instant. We propose a Cumulative Attestation Kernel (CAK) that addresses these concerns. We demonstrate the value of CAKs for Advanced Metering Infrastructure (AMI) and show how to implement a CAK in less than one quarter of the memory available on low end flash MCUs similar to those used in AMI deployments. Regarding this prototype, we present the first formal proof we are aware of that a system is tolerant to power supply interruptions. We also discuss how to provide cumulative attestation for devices with tighter memory constraints by offloading computation and storage onto a Cumulative Attestation Coprocessor (CAC). [ABSTRACT FROM PUBLISHER]

Energy infrastructure is a critical underpinning of modern society that any compromise or sabotage of its secure and reliable operation has an enormous impact on people's daily lives and the national economy. The massive northeastern power blackout of August 2003 and the most recent Florida blackout have both revealed serious defects in both system-level management and device-level designs of the power grid in handling attacks. At the system level, the control area operators lack the capability to 1) obtain real-time status information of the vastly distributed equipment; 2) respond rapidly enough once events start to unravel; and 3) perform coordinated actions autonomously across the region. At the device level, the traditional hardware lacks the capability to 1) provide reliable frequency and voltage control according to system demands and 2) rapidly reconfigure the system to a secure state through switches and power-electronics based devices. These blackouts were a wake-up call for both the industry and academia to consider new techniques and system architecture design that can help assure the security and reliability of the power grid. In this paper, we present a hardware-in-the-loop reconfigurable system design with embedded intelligence and resilient coordination schemes at both local and system levels that would tackle the vulnerabilities of the grid. The new system design consists of five key components: 1) a location-centric hybrid system architecture that facilitates not only distributed processing but also coordination among geographically close devices; 2) the insertion of intelligence into power electronic devices at the lower level of the power grid to enable a more direct reconfiguration of the physical makeup of the grid; 3) the development of a robust collaboration algorithm among neighboring devices to handle possible faulty, missing, or incomplete information; 4) the design of distributed algorithms to better understand the local state of the power grid; and 5) the adoption of a control-theoretic real-time adaptation strategy to guarantee the availability of large distributed systems. Preliminary evaluation results showing the advantages of each component are provided. A phased implementation plan is also suggested at the end of the discussion. [ABSTRACT FROM PUBLISHER]

Demand response has become a key feature of the future smart grid. In addition to having advanced communication and computing infrastructures, a successful demand response program must respond to the needs of a power system. In other words, the efficiency and security of a power system dictate the locations, amounts and speeds of the load reductions of a demand response program. In this paper, we propose an event-driven emergency demand response scheme to prevent a power system from experiencing voltage collapse. A technique to design such a scheme is presented. This technique is able to provide key setting parameters such as the amount of demand reductions at various locations to arm the demand response infrastructure. The validity of the proposed technique has been verified by using several test power systems . [ABSTRACT FROM PUBLISHER]

This letter proposes an imperfect false data injection attack model and its corresponding forecasting-aided implementation method against the nonlinear power system state estimation by introducing an attack vector relaxing error. The upper bound of the relaxing error within the method is presented through theoretical analysis. Simulation experiments on the IEEE 30-bus system show that the proposed method works well both to the nonlinear model and to the dc model. In this letter, both single and multiple state variables attacks are considered. [ABSTRACT FROM PUBLISHER]