Search

This study examines the impact of data integrity attacks on Federated Learning (FL) for load forecasting in smart grid systems, where privacy-sensitive data require robust management. While FL provides a privacy-preserving approach to distributed model training, it remains susceptible to attacks like data poisoning, which can impair model performance. We compare Centralized Federated Learning (CFL) and Decentralized Federated Learning (DFL), using line, ring and bus topologies, under adversarial conditions. Employing a three-layer Artificial Neural Network (ANN) with substation-level datasets ( A P E h o u r l y , P J M E h o u r l y , and C O M E D h o u r l y ), we evaluate the system's resilience in the absence of anomaly detection. Results indicate that DFL significantly outperforms CFL in attack resistance, achieving Mean Absolute Percentage Errors (MAPEs) of 0.48%, 4.29% and 0.702% across datasets, compared to the CFL MAPEs of 6.07%, 18.49% and 10.19%. This demonstrates the potential of DFL as a resilient, secure solution for load forecasting in smart grids, minimizing dependence on anomaly detection to maintain data integrity. [ABSTRACT FROM AUTHOR]

Reinforcement learning (RL) is proven effective in optimizing home battery charging coordination within smart grids. However, its vulnerability to adversarial behavior poses a significant challenge to the security and fairness of the charging process. In this study, we, first, craft five stealthy false data injection (FDI) attacks that under-report the state-of-charge (SoC) values to deceive the RL agent into prioritizing their charging requests, and then, we investigate the impact of these attacks on the charging coordination system. Our evaluations demonstrate that attackers can increase their chances of charging compared to honest consumers. As a result, honest consumers experience reduced charging levels for their batteries, leading to a degradation in the system's performance in terms of fairness, consumer satisfaction, and overall reward. These negative effects become more severe as the amount of power allocated for charging decreases and as the number of attackers in the system increases. Since the total available power for charging is limited, some honest consumers with genuinely low SoC values are not selected, creating a significant disparity in battery charging levels between honest and malicious consumers. To counter this serious threat, we develop a deep learning-based FDI attack detector and evaluated it using a real-world dataset. Our experiments show that our detector can identify malicious consumers with high accuracy and low false alarm rates, effectively protecting the RL-based charging coordination system from FDI attacks and mitigating the negative impacts of these attacks. [ABSTRACT FROM AUTHOR]

The integration of cyber (network) with physical world is a big step in cyber-physical systems. This has revolutionised many industries. But this transformation has made cyber-physical systems vulnerable to attacks. One particular type of attack is the adversarial false data injection which injects false data in either the sensor measurements or the corresponding communication channel. A better understanding of how false data injection (FDI) attacks are constructed is crucial for developing strategies to protect against such attacks. In this paper, we consider two models for networked control systems and present an algorithm for constructing FDI attacks in each case and compare with an existing approach. The conditions for the attack to remain stealthy for systems equipped with a $ \chi ^2 $ χ 2 failure detector and the design of attack vectors that satisfy these conditions are discussed in detail. The algorithms are demonstrated by developing FDI attacks for two real-world examples. [ABSTRACT FROM AUTHOR]

The transition from analog to digital instrumentation and control (I&C) systems introduces new threats caused by cyberattacks in the nuclear industry. This paper proposes a self-healing strategy to respond to a false data injection attack that targets digital I&C systems, which is a type of cyberattack commonly targeting nuclear power plants with the potential to cause serious physical impacts. This resilience strategy for self-healing control contains three components: (1) an anomaly detection model that can detect false data injection attacks, (2) a device-level control that utilizes inferred values to perform control under a detected false data injection, and (3) a system-level control that leverages another controller that is not under attack to lead the system back to a safe operation state when the device-level control is unavailable. Anomaly detection and device-level control use an autoencoder while system-level control utilizes reinforcement learning. The proposed self-healing resilience strategy is demonstrated with a generic pressurized water reactor (GPWR) simulator under false data injections, targeting the steam generator water level. The results show that the proposed strategy effectively leads the system back to a normal operation state under various false data injection cases. [ABSTRACT FROM AUTHOR]

Abstract Recent sensor, communication, and computing technological advancements facilitate smart grid use. The heavy reliance on developed data and communication technology increases the exposure of smart grids to cyberattacks. Existing mitigation in the electricity grid focuses on protecting primary or redundant measurements. These approaches make certain assumptions regarding false data injection (FDI) attacks, which are inadequate and restrictive to cope with cyberattacks. The reliance on communication technology has emphasized the exposure of power systems to FDI assaults that can bypass the current bad data detection (BDD) mechanism. The current study on unobservable FDI attacks (FDIA) reveals the severe threat of secured system operation because these attacks can avoid the BDD method. Thus, a Data-driven learning-based approach helps detect unobservable FDIAs in distribution systems to mitigate these risks. This study presents a new Hybrid Metaheuristics-based Dimensionality Reduction with Deep Learning for FDIA (HMDR-DLFDIA) Detection technique for Enhanced Network Security. The primary objective of the HMDR-DLFDIA technique is to recognize and classify FDIA attacks in the distribution systems. In the HMDR-DLFDIA technique, the min–max scalar is primarily used for the data normalization process. Besides, a hybrid Harris Hawks optimizer with a sine cosine algorithm (hybrid HHO‐SCA) is applied for feature selection. For FDIA detection, the HMDR-DLFDIA technique utilizes the stacked autoencoder (SAE) method. To improve the detection outcomes of the SAE model, the gazelle optimization algorithm (GOA) is exploited. A complete set of experiments was organized to highlight the supremacy of the HMDR-DLFDIA method. The comprehensive result analysis stated that the HMDR-DLFDIA technique performed better than existing DL models.

In today's technologically advanced landscape, sensors feed critical data for accurate decision-making and actions. Ensuring the integrity and reliability of sensor data is paramount to system performance and security. This paper introduces an innovative approach utilizing discrete wavelet transforms (DWT) embedded within microcontrollers to scrutinize sensor data meticulously. Our methodology aims to detect and isolate malfunctions, misuse, or any anomalies before they permeate the system, potentially causing widespread disruption. By leveraging the power of wavelet-based analysis, we embed computational intelligence directly into the microcontrollers, enabling them to monitor and validate their outputs in real-time. This proactive anomaly detection framework is designed to distinguish between normal and aberrant sensor behaviors, thereby safeguarding the system from erroneous data propagation. Our approach significantly enhances the reliability of embedded systems, providing a robust defense against false data injection attacks and contributing to overall cybersecurity. [ABSTRACT FROM AUTHOR]

Non-convex energy distribution system makes distributed renewable energy source (DRES) generation prediction crucial in the smart grid. Moreover, intermittent DRES generation and user-chaotic load variations make quality of service (QoS) in the energy distribution system unreliable. In this article, to address the aforementioned research problem, we proposed the ensemble deep neural network (EDNN) to provide high QoS for distributing energy with multiple microgrids model in congested smart grid. By employing Stackelberg game theory, mapping to optimal energy distribution and main grid power dispatch was reduced. The proposed EDNN-based energy distribution scheme is verified by employing on IEEE 118 bus smart grid system with false data injection. From the case study results, computation time and various performance indexes were obtained. The proposed EDNN scheme outperforms conventional energy management schemes like the Sustainable Energy Distribution and Classification Predicted Residuals schemes. By simulation, we observed that the proposed EDNN use the Stackelberg game to ensure congested lines optimally uses multiple microgrids to avoid congestion. Through an experimental testbed, we observed that the proposed EDNN scheme improves QoS by 10.2%, while reducing testing decision time by 76 s. Hence, an effective smart grid operation is ensured by the proposed EDNN in a multiple-grid system. [ABSTRACT FROM AUTHOR]

In this paper, a new structure, the so-called FBSCUCFDIP-P/EV is proposed as flexibility-based security constrained unit commitment (SCUC) in the presence of false data injection (FDI) attack into the communication infrastructure of electric vehicle parking lot (EVPL). Herein, the uncertain EVPLs are integrated into the SCUC problem with the aim of reducing the operation cost. It is notable that growing integration of unspecified EVPLs can introduce novel challenges to the power system, significantly impacting its flexibility. In this study, electric vehicles are leveraged as a means to enhance system flexibility. Meanwhile, the FDI attacks in EVPLs can distort the system’s flexibility and lead to inaccurate assessments of the power system’s ability to adapt to changing conditions. In order to model the FDI attack, a bi-level optimization problem based on mixed integer linear programming is formulated. At the upper level, the impact of EVPLs on the flexibility indices of the SCUC is evaluated, and the false data injected into the EVPL is calculated at the lower level. Since both levels of the proposed FBSCUCFDIP-P/EV include discrete variables, a reformulation and decomposition technique is utilized to achieve the optimal solution. Instead, an extreme gradient boosting (XGBoost)-based machine learning method is considered to detection and correction of FDI attack. The proposed approach is tested on the IEEE 24-bus system. The simulation results initially indicate the improvement of the flexibility of the power system in proposed structure. Further, injecting false data into all available EVPLs causes to increase the system operation cost. Besides, false data leads to distorted charging and discharging scheduling of EVPLs; likewise, scheduling and commitment of power generation units also changes. Subsequently, the application of the XGBoost algorithm effectively mitigates the impact of FDI attacks, achieving a maximum accuracy of 85.41%.

This paper investigates the frequency restoration problem of islanded microgrids when subjected to malicious data injection. A distributed event-triggered resilient control method based on hidden layer is proposed to mitigate the impact of false data injection (FDI) attacks on microgrids. Unlike traditional estimation-based or compensation-based approaches, the proposed method does not interfere the system during normal operations. Furthermore, this method does not rely on attack detection technology, reducing the complexity of the system. In addition, a dynamic threshold is introduced to dynamically adjust the event-triggered mechanism (ETM) over time, further reducing the number of triggers. The stability of islanded microgrids is analyzed using Lyapunov theory, and the Zeno behavior is avoided. The effectiveness and superiority of this control scheme are verified by simulation examples. [ABSTRACT FROM AUTHOR]

Various studies have demonstrated that the collaborative false command injection (FCI) and false sensory data injection (FDI) attacks can go undetected by the existing detection methods and result in serious cascading failures. Therefore, fast attack-recovery under attacks are gaining importance. However, previous researches cannot know which data are contaminated and real system state cannot be evaluated, which leads to serious misalignment of attack-recovery. In this paper, we propose a novel and effective method based on physical invariants among heterogeneous control commands and sensory data to locate the maliciously modified command or compromised sensor. First, we analyze changes in invariants under different single attacks and depict how to detect the collaborative attack and locate attack targets by utilizing broken invariants. Second, considering localization becomes difficult when multiple attacks may be launched simultaneously to disrupt different components, we build the causal network by utilizing the physical invariants and develop a causal-network-based algorithm to fast locate compromised objects. Finally, our numerical results validate the effectiveness of our proposed methods and algorithms. Our work will build the foundation to achieve real-time and accurate recovery under attacks. [ABSTRACT FROM AUTHOR]

The integration of nuclear reactors into the smart electric grid dictates the digitalization of Instrumentation and Control (I&C) systems, to support advanced networking capabilities (e.g., remote, semi-autonomous operation). However, continuous data transmission could potentially facilitate cyber events targeting nuclear installations. To secure nuclear communications against potential adversaries attempting to impersonate legitimate communicating parties, we propose a real-time processing scheme which does not rely on AI/ML, but uses noise analysis to verify the integrity of exchanged signals and commands. In this work, we evaluate the randomness of noise present in real-world nuclear I&C signals. After constructing a dataset consisting of steady state signals from PUR-1 all-digital reactor, three representative signals are used as case study. The disentropy of the autocorrelation function is used to quantify the amount of randomness present, while the signal observation time window is varied to determine the optimal monitoring length in a real-time cyber event detection scenario. We observe that several I&C signals contain additive components qualifying as white noise, which can therefore be used to evaluate their integrity. By performing several tests replicating cyber event scenarios, using original and adversary-manipulated data, we confirm the validity of our scheme for detecting False Data Injection (FDI) events.

Distribution systems are evolving from traditional passive networks into, what is known as, Active Distribution Networks (ADNs). Unlike traditional distribution networks, ADNs are characterized by bi-directional power flow, the high penetration of DERs, storage capabilities and sophisticated control strategies. Multiple layers of communications, sensing and computation are being integrated into ADNs for monitoring, control and protection of a variety of components and critical operations. This enhanced dependency on information and communication technologies, however, increases the exposure of ADNs to cyber-attacks. Several papers have been published in recent years with a focus on cyber-physical security (CPS) of smart grids. However, the published survey papers primarily emphasize the transmission level of smart grid threats and challenges, with little focus on the ADNs. Given the rapid deployment of ADNs and the increasing cyber threats against power grids and critical infrastructures, we are motivated, in this article, to present a review and survey focused, instead, on the latest research advancements in the area of CPS for ADNs. This paper represents the first survey of timely research in the area of CPS of ADNs with a focus on ADN critical operations and components. The cyber-physical aspects of each critical operation/component are analyzed. In addition, the challenges and requirements of associated communication protocols and standards are presented. Cybersecurity of ADN devices and sensors including Phasor Measurement Units (PMUs), smart meters, advanced metering infrastructure and protection relays are discussed in detail. Moreover, a thorough study of ADNs application drivers and enablers including microgrids, Electric Vehicles (EVs), Internet-of-Things (IoT) and smart homes is conducted. Potential and existing solutions by industry are highlighted. Finally, survey outcomes and directions for future work are presented to highlight emerging avenues of research.

The integration of photovoltaic (PV) panels has allowed power distribution systems (PDSs) to regulate their voltage through the injection/absorption of reactive power. The deployment of information and communication technologies (ICTs), which is required for this scheme, has made the PDS prone to various cyber threats, e.g., false data injection (FDI) attacks. To counter these attacks, this paper proposes a data-driven framework to detect FDI attacks against voltage regulation of PV-integrated PDS. Initially, an attack-free system is modeled along with its voltage regulation scheme, where the grid measurements are sent to a centralized controller and the control signals are transmitted back to PVs to be used by their local controllers. Then, a convolutional neural network (CNN) framework is proposed to detect FDI attacks. To train this framework—which should be able to distinguish between normal grid behaviors and attacks—a complete and realistic dataset is formed to cover all normal conditions and unpredictable changes of a PDS during a year. Since normal variations and fluctuations in power consumption lead to changes in the voltage profile, this dataset is enriched using features such as season, weekdays, weekends, load conditions, and PV generation power. The performance of the trained framework has been compared with other supervised Machine Learning-based and deep-learning techniques for FDI attacks against modified IEEE 33- and 141-bus PDSs. Simulation results demonstrate the superior performance of the proposed framework in detecting FDI attacks.

Reinforcement learning (RL) is proven effective in optimizing home battery charging coordination within smart grids. However, its vulnerability to adversarial behavior poses a significant challenge to the security and fairness of the charging process. In this study, we, first, craft five stealthy false data injection (FDI) attacks that under-report the state-of-charge (SoC) values to deceive the RL agent into prioritizing their charging requests, and then, we investigate the impact of these attacks on the charging coordination system. Our evaluations demonstrate that attackers can increase their chances of charging compared to honest consumers. As a result, honest consumers experience reduced charging levels for their batteries, leading to a degradation in the system’s performance in terms of fairness, consumer satisfaction, and overall reward. These negative effects become more severe as the amount of power allocated for charging decreases and as the number of attackers in the system increases. Since the total available power for charging is limited, some honest consumers with genuinely low SoC values are not selected, creating a significant disparity in battery charging levels between honest and malicious consumers. To counter this serious threat, we develop a deep learning-based FDI attack detector and evaluated it using a real-world dataset. Our experiments show that our detector can identify malicious consumers with high accuracy and low false alarm rates, effectively protecting the RL-based charging coordination system from FDI attacks and mitigating the negative impacts of these attacks.

Abstract The conventional power systems are evolving as smart grids. In recent times cyberattacks on smart grids have been increasing. Among different attacks, False Data Injection (FDI) is considered as an emerging threat that has significant impact. By exploiting the vulnerabilities of IEC 61850 Generic Object-Oriented Substation Events (GOOSE) and Sampled Values (SV) attackers can launch different FDI attacks. In this paper, a real-time set up capable of simulating FDI on GOOSE and SV protocols is developed to evaluate the impact of such attacks on power grid. IEC 62351 stipulates cybersecurity guidelines for GOOSE and SV, but only at communication or Information Technology (IT) level. Hence there is a need to develop a holistic security both at IT and Operation Technology (OT) level. In this regard, a novel sequence content resolver-based hybrid security scheme suitable to tackle FDI attacks on GOOSE and SV is proposed. Furthermore, the computational performance of the proposed hybrid security scheme is presented to demonstrate its applicability to the time critical GOOSE and SV protocols.

The modern electric power grid, known as the Smart Grid, has fast transformed the isolated and centrally controlled power system to a fast and massively connected cyber-physical system that benefits from the revolutions happening in communications (such as 5G/6G) and the fast adoption of Internet of Things devices (such as intelligent electronic devices and smartmeters). While the synergy of a vast number of cyber-physical entities has allowed the Smart Grid to be much more effective and sustainable in meeting the growing global energy challenges, it has also brought with it a large number of vulnerabilities resulting in breaches of data integrity, confidentiality, and availability. False data injection (FDI) appears to be among the most critical cyberattacks and has been a focal point of interest for both research and industry. To this end, this article presents a comprehensive review of the recent advances in defence countermeasures of FDI attacks on the Smart Grid. Relevant existing works of literature are evaluated and compared in terms of their theoretical and practical significance to Smart Grid cybersecurity. In conclusion, a range of technical limitations of existing false data attack detection research is identified, and a number of future research directions are recommended. [ABSTRACT FROM AUTHOR]

Artificial intelligence (AI) advancements have revolutionized many critical domains by providing cost-effective, automated, and intelligent solutions. Recently, ChatGPT has achieved a momentous change and made substantial progress in natural language processing. As such, a chatbot-driven AI technology has the capabilities to interact and communicate with users and generate human-like responses. ChatGPT, on the other hand, has the potential to influence changes in the cybersecurity domain. ChatGPT can be utilized as a chatbot-driven security assistant for penetration testing to analyze, investigate, and develop security solutions. However, ChatGPT raises concerns about how the tool can be used for cybercrime and malicious activities. Attackers can use such a tool to cause substantial harm by exploiting vulnerabilities, writing malicious code, and circumventing security measures on a targeted system. This article investigates the implications of the ChatGPT model in the domain of cybersecurity. We present the state-of-the-art practical applications of ChatGPT in cybersecurity. In addition, we demonstrate in a case study how a ChatGPT can be used to design and develop False data injection attacks against critical infrastructure such as industrial control systems. Conversely, we show how such a tool can be used to help security analysts to analyze, design, and develop security solutions against cyberattacks. Finally, this article discusses the open challenges and future directions of ChatGPT in cybersecurity. [ABSTRACT FROM AUTHOR]

In this paper, the application and future vision of Artificial Intelligence (AI)-based techniques in microgrids are presented from a cyber-security perspective of physical devices and communication networks. The vulnerabilities of microgrids are investigated under a variety of cyber-attacks targeting sensor measurements, control signals, and information sharing. With the inclusion of communication networks and smart metering devices, the attack surface has increased in microgrids, making them vulnerable to various cyber-attacks. The negative impact of such attacks may render the microgrids out-of-service, and the attacks may propagate throughout the network due to the absence of efficient mitigation approaches. AI-based techniques are being employed to tackle such data-driven cyber-attacks due to their exceptional pattern recognition and learning capabilities. AI-based methods for cyber-attack detection and mitigation that address the cyber-attacks in microgrids are summarized. A case study is presented showing the performance of AI-based cyber-attack mitigation in a distributed cooperative control-based AC microgrid. Finally, future potential research directions are provided that include the application of transfer learning and explainable AI techniques to increase the trust of AI-based models in the microgrid domain. [ABSTRACT FROM AUTHOR]

Foundational and state-of-the-art anomaly-detection methods through power system state estimation are reviewed. Traditional components for bad data detection, such as chi-square testing, residual-based methods, and hypothesis testing, are discussed to explain the motivations for recent anomaly-detection methods given the increasing complexity of power grids, energy management systems, and cyber-threats. In particular, state estimation anomaly detection based on data-driven quickest-change detection and artificial intelligence are discussed, and directions for research are suggested with particular emphasis on considerations of the future smart grid. [ABSTRACT FROM AUTHOR]

The conventional power systems are evolving as smart grids. In recent times cyberattacks on smart grids have been increasing. Among different attacks, False Data Injection (FDI) is considered as an emerging threat that has significant impact. By exploiting the vulnerabilities of IEC 61850 Generic Object-Oriented Substation Events (GOOSE) and Sampled Values (SV) attackers can launch different FDI attacks. In this paper, a real-time set up capable of simulating FDI on GOOSE and SV protocols is developed to evaluate the impact of such attacks on power grid. IEC 62351 stipulates cybersecurity guidelines for GOOSE and SV, but only at communication or Information Technology (IT) level. Hence there is a need to develop a holistic security both at IT and Operation Technology (OT) level. In this regard, a novel sequence content resolver-based hybrid security scheme suitable to tackle FDI attacks on GOOSE and SV is proposed. Furthermore, the computational performance of the proposed hybrid security scheme is presented to demonstrate its applicability to the time critical GOOSE and SV protocols. [ABSTRACT FROM AUTHOR]

Power system state estimation is an essential component of the modern power system energy management system (EMS), and accurate state estimation is an indispensable basis for subsequent work. However, the attacker can inject biases into measurements to launch false data injection attacks (FDIAs) in smart grids, which ultimately cause state estimates to deviate from security values. This paper proposed the joint use of static state estimation and dynamic state estimation to detect the FDIA, i.e. the joint use of weighted least squares (WLS) and extended Kalman filter (EKF) with exponential weighting function (WEKF), which improves the robustness of state estimation. Since the WLS estimation considers only the measurements at the current moment, the recursive feature of the WEKF enables the estimation process to involve both historical state and current measurements. Therefore, consistency tests and residual tests were performed using the estimations of WLS and WEKF to effectively detect FDIA. In addition, a cluster partitioning approach with approximate equal redundancy of subsystems is proposed to locate the FDIA. The detection of FDIA triggers the partitioning of the network system, and then the chi-square test is used separately in each sub-network to determine the location of FDIA. Finally, the experimental results in the IEEE-14 bus system and the IEEE-30 bus system demonstrate that the approach can effectively detect and locate FDIAs.

In a smart grid, state estimation (SE) is a very important component of energy management system. Its main functions include system SE and detection of cyber anomalies. Recently, it has been shown that conventional SE techniques are vulnerable to false data injection (FDI) attack, which is a sophisticated new class of attacks on data integrity in smart grid. The main contribution of this paper is to propose a new FDI attack detection technique using a new data-driven SE model, which is different from the traditional weighted least square based SE model. This SE model has a number of unique advantages compared with traditional SE models. First, the prediction technique can better maintain the inherent temporal correlations among consecutive measurement vectors. Second, the proposed SE model can learn the actual power system states. Finally, this paper shows that this SE model can be effectively used to detect FDI attacks that otherwise remain stealthy to traditional SE-based bad data detectors. The proposed FDI attack detection technique is evaluated on a number of standard bus systems. The performance of state prediction and the accuracy of FDI attack detection are benchmarked against the state-of-the-art techniques. Experimental results show that the proposed FDI attack detection technique has a higher detection rate compared with the existing techniques while reducing the false alarms significantly.

Copyright of Ingeniería (0121-750X) is the property of Ingenieria and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

In smart grids, homes are equipped with smart meters (SMs) to monitor electricity consumption and report fine-grained readings to electric utility companies for billing and energy management. However, malicious consumers tamper with their SMs to report low readings to reduce their bills. This problem, known as electricity fraud, causes tremendous financial losses to electric utility companies worldwide and threatens the power grid's stability. To detect electricity fraud, several methods have been proposed in the literature. Among the existing methods, the data-driven methods achieve state-of-art performance. Therefore, in this paper, we study the main existing data-driven electricity fraud detection methods, with emphasis on their pros and cons. We study supervised methods, including wide and deep neural networks and multi-data-source deep learning models, and unsupervised methods, including clustering. Then, we investigate how to preserve the consumers' privacy, using encryption and federated learning, while enabling electricity fraud detection because it has been shown that fine-grained readings can reveal sensitive information about the consumers' activities. After that, we investigate how to design robust electricity fraud detectors against adversarial attacks using ensemble learning and model distillation because they enable malicious consumers to evade detection while stealing electricity. Finally, we provide a comprehensive comparison of the existing works, followed by our recommendations for future research directions to enhance electricity fraud detection. [ABSTRACT FROM AUTHOR]

Stealthy attacks in sensor and actuator loops are the research priorities in the security of cyber-physical systems. Existing attacks define the stealthiness conditions against the Chi-square or Kullback-Leibler divergence detectors and parameterize the attack model based on additive signals. Such conditions ignore the potential anomalies of the vulnerable outputs in the control layer, and the attack sequences need to be generated online, increasing the hardware and software costs. This paper investigates a type of multiplicative attack with essential stealthiness where the employed model is a novel form. The advantage is that the parameters can be designed in a constant form without having to be generated online. An essential stealthiness condition is proposed for the first time and complements the existing ones. Two sufficient conditions for the existence of constant attack matrices are given in the form of theorems, where two methods for decoupling the unknown variables are particularly considered. A quadruple-tank process, an experimental platform for attack and defense, is developed to verify the theoretical results. The experiments indicate that the proposed attack strategy can fulfill both the attack performance and stealthiness conditions. [ABSTRACT FROM AUTHOR]

A teleoperation system is referred to as a plant that is controlled remotely, and it is often composed of a human operator, a local master manipulator, and a remote slave manipulator, all connected by a communication network. Bilateral teleoperation systems (BTOS) include transmissions in both the forward and backward directions between the master and slave. This paper discusses a class of (BTOS) focusing on the security of the system after modeling the master and slave robots mathematically. The false data injection attack is examined, where the attacker may inject false data into the states that are being exchanged between the master and slave robots. The vulnerability of BTOS, where the attack destabilizes the system, is presented. A deep learning-based detection technique is proposed to detect the presence of false data injection attacks. The deep learning model with convolution neural network structure is trained and tested with considering complex attacks where the attacker has full knowledge of the system and proficiency to emanate and control the target system. The proposed model achieves 96% validation accuracy, and the efficacy of the proposed deep learning detector is demonstrated and tested into the BTOS. [ABSTRACT FROM AUTHOR]

The technical improvements in modern power systems by the use of smart sensors, smart meters, multi-direction communication networks, and computers have given birth to the cyber-physical smart grid networks. Any attack on the grid is a threat to the grid's operation and the data collected from it. Therefore, the security of this diverse network is the primary concern. Two attacks on a smart grid network tested in this paper are: Denial of Service (DoS) and Man In The Middle (MITM). Remote monitoring of the smart meter under either of the attacks indicates load fluctuations on the consumer side. It is seen that the location of these fluctuations is not limited to the area under attack. The supplier has to bear the economic effects. This paper discusses the cyber, physical and monetary impact of different cyber-attacks on a smart meter. An experiment is conducted on a hardware setup connected to a constant load, and the findings are noted. The two attacks are then extended to an IEEE-30 bus system and their impact is studied using MATPOWER simulations. For the same experimental setup, a protection scheme is also tested. The protection scheme is divided based on the attack condition: pre-attack, under-attack and post-attack conditions. Cryptographic data security in the pre-attack conditions is explored using MATLAB simulations where a binary coded password scheme is devised and then extended for a smart grid system. Multi-level encryption methods are used to prevent data breaches during attacks. The importance of firewall and antivirus databases is also analyzed.

The potential of wide area control (WAC) to improve power system stability encourages utility incorporating phasor measurement units (PMUs) at different nodes. Higher usage of PMU makes the power network more vulnerable to cyber attack (CA) which is a concern for the system operator. Mitigation of the CA is important for any WAC operation. In this paper, a false data mitigation (FDM) strategy is proposed for WAC to maintain stability of the power system even during CA. The proposed FDM filters out the data received from the attacked PMUs, if any, and accordingly modifies the WAC model in the phasor data concentrator. The WAC continues its operation with the modification and using the data from the unattacked PMUs. The proposed FDM technique is tested in the New England 39 bus system and compared with the available dynamic state estimation (DSE) method. • A strategy is proposed to mitigate the impact of false data in wide area control (WAC). • The proposed method modifies the state space model of WAC. • To mitigate the impact of attack in WAC, the proposed models avoid estimation methods. [ABSTRACT FROM AUTHOR]

The rising deployment of electric vehicle charging stations (EVCS) in existing power grids and their integration with electric vehicles through communication systems are increasingly vulnerable to cyber-attacks, such as false data injection (FDI) and uncertainties of communication system. This research introduces an EVCS evaluation from a techno-economic standpoint, utilizing the developed and data-oriented TSKFS&MADRL technique to identify and rectify inaccuracies stemming from cyber-attacks like FDI and communication system delays. This method aims to enhance the resilience of EVCSs against sabotage attacks by ensuring fast dynamic responses. Initially, the study models the potential targets of hackers, such as communication systems and transducer sensors, and employs the Euclidean norm theory, weighted least square error method, and residual error technique to identify cyber-attacks resulting from FDI through the comparison of measured data with reference values based on probability distribution functions. Subsequently, the network control and recovery requirements are facilitated by the proposed controller. The proposed approach application has been demonstrated in the IEEE 33 bus, showcasing a 7.33 % lower experimental operation cost compared to the RL method and 12.15 % lower than the CNN method. Additionally, the FDI detection time is observed to be 40 % quicker than alternative methods based on the experimental outcomes. • Improving EVCS resilience against cyber-attacks. • Improving the accuracy of tracking cyber-attack targets. • Enhancement of the dynamic response and robust control framework. [ABSTRACT FROM AUTHOR]

Cyber-physical systems face cyberattacks that hinder performance, increase cost, or even collapse the system. Thus, rapid and accurate attack detection is crucial for quick activation of defense mechanisms. Model-based attack detection approaches are known for their precision; however, the unavailability of the exact system model poses a challenge. In response, model-free approaches have gained increased attention as a practical alternative. In this paper, an online model-free algorithm for detecting false data injection and jamming attacks on CPSs is proposed. The method leverages principal component analysis to reconstruct the expected observations in a reduced dimension space, emphasizing the most effective principal components. Then, deciding on attacked or normal operation relies on analyzing either the Euclidean distance or the cosine similarity of the discrepancy between the expected and actual observations. The proposed metrics effectively expose subtle deviations from expected behavior, as any alteration in these components augments the distance between the observed and reconstructed values. The proposed method was compared with the conventional cumulative sum discriminator and Kalman-based algorithm, using an IEEE-14, IEEE-30, and IEEE-118 bus systems. The results demonstrate the superiority of the proposed algorithm in terms of various evaluation metrics, including F-score, precision, recall, and miss detection ratio. [ABSTRACT FROM AUTHOR]

• Introducing a new FBSCUC FDI P-P / EV structure as flexibility-based security constrained unit commitment in the presence of false data injection attack in to the communication infrastructure of EVs. • Examining the flexible-oriented approach of uncertain EVs in SCUC with the aim of reducing the operating cost and increasing the flexibility indices. • Proposing an operator-adversary bilevel optimization problem to evaluate the impact of false data injection attacks on the electric vehicles parking lots in the flexibility-based SCUC. • Applying a defense mechanism using XGBoost-based machine learning approach to detect and correct false data injected into electric vehicles parking lots. In this paper, a new structure, the so-called FBSCUC FDI P-P / EV is proposed as flexibility-based security constrained unit commitment (SCUC) in the presence of false data injection (FDI) attack into the communication infrastructure of electric vehicle parking lot (EVPL). Herein, the uncertain EVPLs are integrated into the SCUC problem with the aim of reducing the operation cost. It is notable that growing integration of unspecified EVPLs can introduce novel challenges to the power system, significantly impacting its flexibility. In this study, electric vehicles are leveraged as a means to enhance system flexibility. Meanwhile, the FDI attacks in EVPLs can distort the system's flexibility and lead to inaccurate assessments of the power system's ability to adapt to changing conditions. In order to model the FDI attack, a bi-level optimization problem based on mixed integer linear programming is formulated. At the upper level, the impact of EVPLs on the flexibility indices of the SCUC is evaluated, and the false data injected into the EVPL is calculated at the lower level. Since both levels of the proposed FBSCUC FDI P-P / EV include discrete variables, a reformulation and decomposition technique is utilized to achieve the optimal solution. Instead, an extreme gradient boosting (XGBoost)-based machine learning method is considered to detection and correction of FDI attack. The proposed approach is tested on the IEEE 24-bus system. The simulation results initially indicate the improvement of the flexibility of the power system in proposed structure. Further, injecting false data into all available EVPLs causes to increase the system operation cost. Besides, false data leads to distorted charging and discharging scheduling of EVPLs; likewise, scheduling and commitment of power generation units also changes. Subsequently, the application of the XGBoost algorithm effectively mitigates the impact of FDI attacks, achieving a maximum accuracy of 85.41%. [ABSTRACT FROM AUTHOR]

In this paper, the application and future vision of Artificial Intelligence (AI)-based techniques in microgrids are presented from a cyber-security perspective of physical devices and communication networks. The vulnerabilities of microgrids are investigated under a variety of cyber-attacks targeting sensor measurements, control signals, and information sharing. With the inclusion of communication networks and smart metering devices, the attack surface has increased in microgrids, making them vulnerable to various cyber-attacks. The negative impact of such attacks may render the microgrids out-of-service, and the attacks may propagate throughout the network due to the absence of efficient mitigation approaches. AI-based techniques are being employed to tackle such data-driven cyber-attacks due to their exceptional pattern recognition and learning capabilities. AI-based methods for cyber-attack detection and mitigation that address the cyber-attacks in microgrids are summarized. A case study is presented showing the performance of AI-based cyber-attack mitigation in a distributed cooperative control-based AC microgrid. Finally, future potential research directions are provided that include the application of transfer learning and explainable AI techniques to increase the trust of AI-based models in the microgrid domain.

Machine learning is a popular approach to security monitoring and intrusion detection in cyber-physical systems (CPS) like the smart grid. However, these highly dynamic CPS operating in open environments can result in significant data distribution divergence, which may require the adaptation of a learned model. While transfer learning has been an effective approach to retain the performance against the divergence, there is still limited work on a more fundamental question that can be called transferability: when should one apply transfer learning? To address this challenge, this paper proposes a divergence-based transferability analysis to decide whether to apply transfer learning and autonomically adapt learning-based intrusion detectors. This work first identifies three metrics used to measure the divergence between data distributions, and then explores the relation between detector’s accuracy drop and divergence in extensive temporal, spatial, and spatiotemporal experiments. Two regression models are trained to approximate the divergence-accuracy relation and then used to predict an accuracy drop which determines whether to apply transfer learning. Finally, a state-of-the-art domain adversarial neural network (DANN) classifier is adopted as the transfer learning model. Datasets from real normal operation profiles and simulated attacks are used to validate the effectiveness of the proposed transferability analysis against variations in attack timing, locations, and both. In all three scenarios, the proposed analysis demonstrated high accuracy in predicting accuracy drop from the divergence, with an RMSE lower than 4.20%, and the DANN can be timely triggered to achieve an accuracy improvement over 5.00%.

Communication plays a vital role in incorporating smartness into the interconnected power system. However, historical records prove that the data transfer has always been vulnerable to cyber-attacks. Unless these cyber-attacks are identified and cordoned off, they may lead to black-out and result in national security issues. This paper proposes an optimal two-stage Kalman filter (OTS-KF) for simultaneous state and cyber-attack estimation in automatic generation control (AGC) system. Biases/cyber-attacks are modeled as unknown inputs in the AGC dynamics. Five types of cyber-attacks, i.e., false data injection (FDI), data replay attack, denial of service (DoS), scaling, and ramp attacks, are injected into the measurements and estimated using OTS-KF. As the load variations of each area are seldom available, OTS-KF is reformulated to estimate the states and outliers along with the load variations of the system. The proposed technique is validated on the benchmark two-area, three-area, and five-area power system models. The simulation results under various test conditions demonstrate the efficacy of the proposed filter.

The blossom of renewable energy worldwide and its uncertain nature have driven the need for a more intelligent power system with the deep integration of smart power electronics. The smart inverter is one of the most critical components for the optimal operation of Smart Grid. However, due to the deep information and communication technology (ICT) infrastructure implementation that most inverter-based smart power systems tend to have, they are vulnerable to severe external threats such as cyberattacks by hackers. This paper presents a comprehensive review of the system structure and vulnerabilities of typical inverter-based power system with distributed energy resources (DERs) integration, nature of several types of cyberattacks, state-of-the-art defense strategies including several detection and mitigation techniques, and an overview and comparison of testbed and simulation tools applicable for cyber-physical research. Finally, challenges, unsolved problems, and future direction of the field are discussed and concluded at the end of the journal. This paper provides an all-inclusive survey at the state of the art smart grid cybersecurity research and paves the path for potential research topics in the future.

Although state estimation using a bad data detector (BDD) is a key procedure employed in power systems, the detector is vulnerable to false data injection attacks (FDIAs). Substantial deep learning methods have been proposed to detect such attacks. However, deep neural networks are susceptible to adversarial attacks or adversarial examples, where slight changes in inputs may lead to sharp changes in the corresponding outputs in even well-trained networks. This article introduces the joint adversarial example and FDIAs (AFDIAs) to explore various attack scenarios for state estimation in power systems. Considering that perturbations added directly to measurements are likely to be detected by BDDs, our proposed method of adding perturbations to state variables can guarantee that the attack is stealthy to BDDs. Then, malicious data that are stealthy to both BDDs and deep learning-based detectors can be generated. Theoretical and experimental results show that our proposed state-perturbation-based AFDIA method (S-AFDIA) can carry out attacks stealthy to both conventional BDDs and deep learning-based detectors, while our proposed measurement-perturbation-based adversarial FDIA method (M-AFDIA) succeeds if only deep learning-based detectors are used. The comparative experiments show that our proposed methods provide better performance than state-of-the-art methods. Besides, the ultimate effect of attacks can also be optimized using the proposed joint attack methods. [ABSTRACT FROM AUTHOR]

For attack detection in the smart grid, transfer learning is a promising solution to tackle data distribution divergence and maintain performance when facing system and attack variations. However, there are still two challenges when introducing transfer learning into intrusion detection: when to apply transfer learning and how to extract effective features during transfer learning. To address these two challenges, this paper proposes a transferability analysis and domain-adversarial training (TADA) framework. The framework first leverages various data distribution divergence metrics to predict the accuracy drop of a trained model and decides whether one should trigger transfer learning to retain performance. Then, a domain-adversarial training model with CNN and LSTM is developed to extract the spatiotemporal domain-invariant features to reduce distribution divergence and improve detection performance. The TADA framework is evaluated in extensive experiments where false data injection (FDI) attacks are injected at different times and locations. Experiments results show that the framework has high accuracy in accuracy drop prediction, with an RMSE lower than 1.79%. Compared to the state-of-the-art models, TADA demonstrates the highest detection accuracy, achieving an average accuracy of 95.58%. Moreover, the robustness of the framework is validated under different attack data percentages, with an average F1-score of 92.02%. [ABSTRACT FROM AUTHOR]

This paper mainly studies vector-related learning and pairwise optimization feature selection for false data injection attack detection in smart grid. In order to provide experimental detection of false data injection attacks, this article will conduct a detailed analysis of the power system segmentation. This paper comprehensively considers the similarity of nodes, security control and confidentiality strategies to complete the optimal partition. Next, we preprocess the measurement data. In order to improve the adaptability of the algorithm structure to the grid structure and further improve the accuracy and convergence speed of the algorithm output, a differential evolution algorithm with swarm intelligence is proposed. Obtain a higher-precision state estimate useful for detecting bad data. In the experiment of this article, if false data account for 20% of all data, the detection accuracy exceeds 75%. As the number of experimental groups increases, the detection accuracy of only one type of false data that does not meet the rules will continue to increase, but the detection accuracy of other types of false data will not change much, but the overall detection accuracy will become higher. Experimental results show that the detection framework can not only effectively detect and identify false data injection attacks on multiple bus nodes, but also has high detection accuracy and can effectively recover false data. [ABSTRACT FROM AUTHOR]

Smart grid is an emerging system providing many benefits in digitizing the traditional power distribution systems. However, the added benefits of digitization and the use of the Internet of Things (IoT) technologies in smart grids also poses threats to its reliable continuous operation due to cyberattacks. Cyber–physical smart grid systems must be secured against increasing security threats and attacks. The most widely studied attacks in smart grids are false data injection attacks (FDIA), denial of service, distributed denial of service (DDoS), and spoofing attacks. These cyberattacks can jeopardize the smooth operation of a smart grid and result in considerable economic losses, equipment damages, and malicious control. This paper focuses on providing an extensive survey on defense mechanisms that can be used to detect these types of cyberattacks and mitigate the associated risks. The future research directions are also provided in the paper for efficient detection and prevention of such cyberattacks. [ABSTRACT FROM AUTHOR]

The safe and efficient function of critical national infrastructure (CNI) relies on the accurate demand forecast. Cyber-physical system-based demand forecasting systems (CDFS), typically found in CNI (such as energy, water, and transport), are highly vulnerable to being compromised under false data injection attacks (FDIAs). The problem is that the majority of existing CDFS employ anomaly-based intrusion detection systems (AIDS) to combat FDIAs. Since the distribution of demand time series keeps changing naturally with time, AIDS treat a major change in the distribution as an attack, but this approach is not effective against colluding FDIAs. To overcome this problem, we propose a novel resilient CDFS called PRDFS (Proposed Resilient Demand Forecasting System). The primary novelty of PRDFS is that it uses signature-based intrusion detection systems (SIDS) that automatically generate attack signatures through the game-theoretic approach for the early detection of malicious nodes. We simulate the performance of PRDFS under colluding FDIA on High Performance Computing (HPC). The simulation results show that the demand forecasting resilience of PRDFS never goes below 80%, regardless of the percentage of malicious nodes. In contrast, the resilience of the benchmark system decreases sharply from about 99% to less than 30%, over the simulation period as the percentage of malicious nodes increases. [ABSTRACT FROM AUTHOR]