Search

When False Data Injection (FDI) attacks inject false data into the controllers of a microgrid, it can lead the controllers to make decisions based on inaccurate information, ultimately resulting in system collapse. This study presents a novel approach to dynamically adjust output voltage in Campus Microgrids (CMG). Initially, we use feedback linearization techniques to address the inherent nonlinear complexities in Distributed Generation (DG) dynamics. Moreover, during voltage regulation, controllers and sensors may be susceptible to FDI attacks. To address this, an elastic follower observer is introduced to mitigate the impact of false information injection attacks on voltage coordination, thus ensuring the robustness and stability of the system. Notably, our method reduces dependence on global information and fault boundaries within the communication network, thereby enhancing system elasticity and efficiency. In conclusion, through comprehensive simulation experiments, we evaluate the effectiveness and performance of our proposed strategy. The simulation results validate the success of our approach in voltage regulation and its efficiency in fault management. These findings bear significant implications for the advancement of voltage regulation strategies in distributed generation systems. [ABSTRACT FROM AUTHOR]

When False Data Injection (FDI) attacks inject false data into the controllers of a microgrid, it can lead the controllers to make decisions based on inaccurate information, ultimately resulting in system collapse. This study presents a novel approach to dynamically adjust output voltage in Campus Microgrids (CMG). Initially, we use feedback linearization techniques to address the inherent nonlinear complexities in Distributed Generation (DG) dynamics. Moreover, during voltage regulation, controllers and sensors may be susceptible to FDI attacks. To address this, an elastic follower observer is introduced to mitigate the impact of false information injection attacks on voltage coordination, thus ensuring the robustness and stability of the system. Notably, our method reduces dependence on global information and fault boundaries within the communication network, thereby enhancing system elasticity and efficiency. In conclusion, through comprehensive simulation experiments, we evaluate the effectiveness and performance of our proposed strategy. The simulation results validate the success of our approach in voltage regulation and its efficiency in fault management. These findings bear significant implications for the advancement of voltage regulation strategies in distributed generation systems.

The increasing number of inverter-based resources (IBR) in the grid introduces new challenges due to the fast transient response and low inertia of IBRs. Set point automatic adjustment with correction enabled (SPAACE)–based techniques smoothen the transient response of an IBR already installed in a grid by modifying its set point without accessing its internal parameters in a model-free approach. Coordinated SPAACE (CSPAACE) further enhances SPAACE performance by incorporating communication links to exchange tracking error values between IBRs; however, this creates openings for cyberattacks. This work adds a detection and mitigation algorithm for both denial of service (DoS) and false data injection (FDI) attacks on the communication channels. Long short-term memory (LSTM) detects anomalies in the inputs received from other inverters, and bidirectional LSTM (BiLSTM) mitigates the adverse effect of attacks on the voltage and frequency stability of a microgrid. A hybrid co-simulation platform is developed using a computer running PSCAD/EMTDC software, a network switch, and two Raspberry Pi computers, where the cyberattacks are conducted on the network switch using one of the Pis. The testbed is used to study the effectiveness of the proposed detection and mitigation method under DoS and FDI attacks and various grid transients.

This paper proposes a framework to optimally employ static VAR compensators (SVCs) within a customized reconfiguration of system topology, leading to remediation of voltage violations caused by false data injection (FDI) cyberattacks targeting smart distribution grids. The designed framework contains formulations associated with planning and operation phases. In the planning phase, the scrutinized system, modified by photovoltaic (PV) units, is enhanced by optimally allocating static VAR compensators (SVCs) to keep the unity power factor throughout the system. Then, distribution system operator (DSO), being in attacker’s shoe, examines relevant cyberattack scenarios leading to voltage violations within the distribution system. Finally, in the operation phase, DSO takes advantage of the optimally planned SVCs to identify proper vectors (i.e., remedial actions) to cope with such potential scenarios of cyberattacks. These (to be recognized) vectors are associated with the variable shunt susceptance of the mentioned SVCs, which will be identified by solving a customized distribution feeder reconfiguration (DFR) problem in the operation phase. The main objective of the customized DFR is to maximize the contributions of SVCs through enhancing the voltage profile of the targeted system. This will enable DSO to mitigate the negative impacts of the FDI attacks and recover the voltage profile of the smart distribution network. The effectiveness of the proposed RAS is validated on three different smart test systems (i.e., 33-bus, 95-bus, and 136-bus systems), which are modified to contain SVC components and renewable-based distributed generation (DG) units.

Non-technical losses (NTL) pose multiple challenges across distribution grids. This paper introduces a comprehensive framework combining data-driven methods to detect and categorize fraud due to meter tampering or direct connections while identifying potential culprits. The hybrid methodology utilizes grid and consumer-related data to obtain NTL curves through an energy balance approach, yielding indicators such as magnitude, duration, and other features. A Random Forest classifier trained with real historical cases of NTL achieves a weighted F1 score of 0.859, effectively labelling fraud types. Additionally, an unsupervised detection model, integrating clustering and correlation methods, enables accurate identification of tampered meters. The paper introduces two adjustable parameters enabling utilities to fine-tune meter tampering detection strategies based on economic considerations. The results demonstrate that true positives can be increased at the expense of increasing false positives. Accurate fraud identification is achieved using the Fuzzy C-Means algorithm, with an F1 score of 0.9. The algorithm is tested on grids with distributed generation, with a decrease of 10% on the predictive performance when half of the users are prosumers, demonstrating the methodology’s promising performance in real-world scenarios.

In light of the advancement of the technologies used in industrial control systems, securing their operation has become crucial, primarily since their activity is consistently associated with integral elements related to the environment, the safety and health of people, the economy, and many others. This work presents a distributed, machine learning based attack detection and mitigation framework for sensor false data injection cyber-physical attacks in industrial control systems. It is developed using the system’s standard operational data and validated using a hybrid testbed of a reverse osmosis plant. A MATLAB/Simulink-based simulation model of the process validated with actual data from a local plant is used. The control system is implemented using Siemens S7-1200 programmable logic controllers with 200SP Distributed Input/Output modules. The proposed solution can be adopted in the existing industrial control systems and demonstrated effective performance in real-time detection and mitigation of actual cyber-physical attacks launched by compromising the communication links between the process and the programmable logic controllers.

The modern smart grid (SG) is mainly a cyber-physical system (CPS), combining the traditional power system infrastructure with information technologies. SG is frequently threatened by cyber attacks such as False Data Injection (FDI), which manipulates the states of power systems by adding malicious data. To maintain a reliable and secure operation of the smart grid, it is crucial to detect FDI attacks in the system along with their exact location. The conventional Bad Data Detection (BDD) algorithm cannot detect such stealthy attacks. So, motivated by the most recent deep learning (DL) developments and data-driven solutions, a new transformer-based model named XTM is proposed to detect and identify the exact locations of data intrusions in real-time scenarios. XTM, which combines the transformer and long short-term memory (LSTM), is the first hybrid DL model that explores the performance of transformers in this particular research field. First, a new threshold selection scheme is introduced to detect the presence of FDI, replacing the need for conventional BDD. Then, the exact intrusion point of the attack is located using a multilabel classification approach. A formally verified constraints satisfaction-based attack vector model was used to manipulate the data set. In this work, considering the temporal nature of power system, both hourly and minutely sensor data are used to train and evaluate the proposed model in the IEEE-14 bus system, achieving a detection accuracy of almost 100%. The row accuracy (RACC) metric was also evaluated for the location detection module, with values of 92.99% and 99.99% for the hourly and minutely datasets, respectively. Moreover, the proposed technique was compared with other deep learning models as well, showing that the proposed model outperforms the state-of-the-art methods mentioned in the literature. [ABSTRACT FROM AUTHOR]

As power systems are gradually evolving into more efficient and intelligent cyber–physical energy systems with the large-scale penetration of renewable energies and information technology, they become increasingly reliant upon more accurate and complex forecasting. The accuracy and generalizability of the forecasting rest, to a great extent, upon the data quality, which is very susceptible to cyberattacks. False data injection (FDI) attacks constitute a class of cyberattacks that could maliciously alter a large portion of supposedly protected data, which may not be easily detected by existing operational practices, thereby deteriorating the forecasting performance causing catastrophic consequences in the power system. This article proposes a novel data-driven FDI attack detection mechanism to automatically detect the intrusions and thus enrich the reliability and resiliency of energy forecasting systems. The proposed mechanism is based on cross-validation, least-squares, and z-score metric providing accurate detections with low computational cost and high scalability without utilizing either system’s models or parameters. The effectiveness of the proposed detector is corroborated through six representative tree-based wind power forecasting models. Experiments indicate that corrupted data injected into input, output, and input–output data is properly located and removed, whereby the accuracy and generalizability of the final forecasts are recovered. [ABSTRACT FROM AUTHOR]

The introduction of information and communication technologies makes network environments increasingly open, leaving smart-grid control systems incredibly vulnerable to malicious attacks. False data injection (FDI) attacks stealthily tamper with measurement data, resulting in erroneous decisions made by the control center that greatly influence the normal operation of the power system. By taking advantage of real-time data acquisition with edge computing, in this article, we propose a scheme based on classification of predicted residuals (CPRs) for the FDI attack detection. The CPR scheme first predicts the acquired measurement data at the edge of the sensing network via developing an accurate prediction model. Followed the novel real-time classification method under the edge devices supporting, it classifies the predicted residuals independent of the false data to enhance the detection accuracy. Through these two steps, the detection rate of FDI attacks is greatly improved. The proposed scheme is validated in a real microgrid testbed. Experimental results show that the CPR scheme performs well in detecting FDI attacks and remains sensitive in injection attack probability and magnitude. The detection scheme even has effectiveness at low injection attack probability and magnitude (5% and 0.018 per thousand, respectively). Furthermore, it also proves that the proposed scheme has applicability in high real-time requirements at the edge of smart grids. [ABSTRACT FROM AUTHOR]

Conventional distributed secondary control is vulnerable to the false data injection (FDI) attacks in regulating power electronics (PE)-based DC microgrids. To address this issue, a sliding mode observer (SMO) based distributed secondary control has been proposed to detect and compensate the FDI signals. However, the SMO suffers from inevitable chattering that deteriorates the steady-state performance. To this end, a high-order differentiator (HoD) based distributed secondary control is proposed in this paper. The proposed control can not only eliminate the chattering, but also improve the dynamics with shorter settling time. It is inherited from the conventional distributed control by only requiring neighboring communication to provide references for the primary-layer control in achieving bus voltage restorations, output current sharing, and output power sharing of PE-based systems. Both simulation and experimental results have verified that the proposed control can compensate different types of FDI attacks and showcase its superior dynamic performance than SMO without chattering. [ABSTRACT FROM AUTHOR]

This article proposes a novel approach to uncover deficiencies of the existing cyber-attack detection schemes and thereby to serve as a foundation for establishing more reliable cybersecure solutions, with particular application in dc microgrids. For this purpose, a multiagent deep reinforcement learning (RL)-based algorithm is proposed to automatically discover the vulnerable spots in the conventional index-based cyberattack detection schemes and automatically generate coordinated stealthy destabilizing false data injection (FDI) attacks on cyber-protected islanded dc microgrids. To enable a continuous action space for the trained RL agents and enhance the algorithm’s precision and convergence rate, deep deterministic policy gradient is incorporated. Using this approach, susceptibility of a state-of-the-art detection scheme to several different coordinated FDI attacks on the distributed communication links is identified. The proposed algorithm is also enhanced with a sniffing feature to enable maintaining the stealthy attacks even under the sudden disconnection of any of the compromised links. To address the discovered deficiencies within the index-based detection scheme, a complementary multiagent RL detection algorithm using deep $Q$ -network algorithm is integrated, which provides a more reliable overall identification performance. Taking into account the communication delays and load changes, the effectiveness of the proposed algorithm is verified by the experimental tests. [ABSTRACT FROM AUTHOR]

In this paper, a cyber-physical system (CPS) is considered, whose state estimation is done by a central controller (CC) using the measurements received from a wireless powered sensor network (WPSN) over fading channels. An adversary injects false data in this system by compromising some of the idle sensor nodes (SNs) of the WPSN. Using the WPSN for transmitting supervision and control data, in the aforementioned setting, makes the CPS vulnerable to both error and false data injection (FDI). The existing techniques of launching stealthy FDI attack are not applicable to the aforementioned network due to the random nature of wireless channels, which is used for both transmitting control and false data. The objectives of the adversary and the CC to launch stealthy FDI attack and to detect the same, respectively, are found to be depending on the powers they use for transmitting data over wireless channels. The transmit powers of the CC, and the adversary that fulfill their respective objectives are derived by modeling their interaction as a Bayesian Stackelberg game. Based on their objectives, novel utility functions are defined for the CC and the adversary. Subsequently, the equilibrium of the proposed game is obtained by solving a non-convex bi-level quadratic-quadratic program. Finally, the analytical results are verified and compared with other state-of-art techniques by applying them in a realistic smart grid simulations. [ABSTRACT FROM AUTHOR]

The increased integration of cyber and communication networks in microgrids for obtaining measurements and relaying controls results in a cyber-physical microgrid (CPM) that paves the way for many essential applications. One of these applications is the load frequency control (LFC), which is more challenging due to the stochastic behavior of renewable generation. The CPM also facilitates the participation of electric vehicle batteries in LFC. These information and communication technologies provide a myriad of advantages but also lead to a close synergy between heterogeneous physical and cyber components unlocking access points for cyber intrusions. A cyber intrusion camouflages and may present itself as uncertainty, eventually leading to astray controls and remedial actions. This leads to a need for an observer-based control strategy that can observe stochastic dynamic encumbrances and remunerate for them through a two-layer controller. The proposed controller is also investigated for its efficacy through hardware-in-the-loop simulations in OPAL-RT that integrates the fidelity of physical simulations with the flexibility of numerical simulations. [ABSTRACT FROM AUTHOR]

While wide-area communication networks facilitate the exchange of measurements and control signals for wide-area damping controllers, they bring in new threats of cyberattacks. This article formulates the dynamic interaction between an intelligent spoof attacker and the wide-area damping control (WADC) center as a zero-sum two-player Markov game. In this Markov game, the attacker intelligently spoofs the communication links sending wide-area control signals to selected generators while the WADC selectively encrypts transmitted control signals with limited cyberresources. The successful spoof of specific communication links leads to the degradation of the WADC performance and even to system instability indicated by the real part of the targeted interarea oscillation mode. The potential performance degradation in the physical layer is uniquely included in the cost function of this game while the other two parts of the cost function are the cybersecurity investments of both the attacker and the WADC (defender). The minimax Q-learning approach is used to obtain the optimal defense and attack strategies. Simulation results show that the strategies for the attacker and the WADC converge within 3000 iterations by using the minimax Q-learning approach. The proposed Markov game provides a cyberphysical framework to make the optimal defense strategy for the WADC. [ABSTRACT FROM AUTHOR]

The smart grid combines the classical power system with the information technology, leading to a cyber-physical system. In such an environment, the malicious injection of data has the potential to cause severe consequences. Classical residual-based methods for bad data detection are unable to detect well designed false data injection (FDI) attacks. Moreover, most of the works on FDI attack detection are based on the linearized DC model of the power system and fails to detect attacks based on the AC model. The aim of this paper is to address these problems by using the graph structure of the grid and the AC power flow model. We derive an attack detection method that is able to detect previously undetectable FDI attacks. This method is based on concepts originating from graph signal processing (GSP). The proposed detection scheme calculates the graph Fourier transform of an estimated grid state and filters the graph’s high-frequency components. By comparing the maximum norm of this outcome with a threshold, we can detect the presence of FDI attacks. Case studies on the IEEE 14-bus system demonstrate that the proposed method is able to detect a wide range of previously undetectable attacks, both on angles and on magnitudes of the voltages. [ABSTRACT FROM AUTHOR]

Addressing the challenges of microgrid control in the face of load variations and the proliferation of renewable energy sources is critical. Additionally, the vulnerability of microgrids to cyber disruptions due to their reliance on communication systems and digital interfaces necessitates innovative control solutions. This paper proposes an integrated approach to controlling an islanded microgrid, leveraging model-free and model-based techniques. While model-based methods enhance grid efficiency, they have limitations in handling cyber anomalies. Conversely, model-free techniques excel at identifying and managing cyber disruptions. We present a novel two-tiered strategy employing data-driven and artificial intelligence methodologies. This approach is designed to detect and mitigate False-Data Injection (FDI) attacks, bolstering microgrid resilience against cyber disruptions. Our simulation results demonstrate the robust and resilient performance of the proposed controller in comparison to conventional methods. • Combines model-free and model-based methods for autonomous microgrid control. • Differentiates between model-based and model-free control techniques. • Two-tier strategy boosts microgrid resilience against cyber FDI attacks. [ABSTRACT FROM AUTHOR]

In microgrids, distributed load sharing plays an important role in maintaining the supply–demand balance of power. Because false data injection (FDI) is one of the crucial threats faced by future microgrids, the study of the impact of FDI on distributed load sharing is both of theoretical merit and practical value. In this paper, we consider the distributed load sharing problem of the microgrids operating in autonomous mode under FDI. Each bus is assumed to be equipped with an agent. Under a well-developed distributed load sharing protocol based on multiagent systems, we first construct an FDI attack model, where the attacker is capable of injecting false data into the bus agents. Then, a utilization level is introduced for coordinating generators, and its variation is evaluated in the presence of FDI attacks with given injection strategies. The stable region of the microgrid is defined, and conditions are given to determine stability. Finally, theoretical results are validated on the Canadian urban distribution system. [ABSTRACT FROM AUTHOR]

Load frequency control (LFC) is widely employed to regulate power plants in modern power generation systems of smart grids. This paper presents a simple and yet powerful type of attacks, referred to as resonance attacks, on LFC power generation systems. Specifically, in a resonance attack, an adversary craftily modifies the input of a power plant according to a resonance source (e.g., rate of change of frequency) to produce a feedback on LFC power generation system, such that the state of the power plant quickly becomes instable. Extensive computer simulations on popular LFC power generation system models which consist of linear, non-linear, and/or high-order items clearly demonstrate the effectiveness of the proposed attacks. As the attack has very low computational cost and communication overhead, it is easy to launch in resource-limited devices such as intelligent electronic devices. In our simulations, the attacker keeps modified input within the normal operating range so as to invade plausibility and consistency based attack detection methods and yet the modifications can quickly drive the system beyond the admissible boundary. Another interesting finding is that by maliciously modifying the input such as power load and tie-line signal over multi-area interconnection channels, a multi-area LFC power generation system could become unreliable more quickly than a single-area system. Finally, we propose countermeasures on the proposed attacks. [ABSTRACT FROM AUTHOR]

For reliable operation and control of smart grid, estimating the correct states is of utmost importance to the system operator. With recent incorporation of information technology and advanced metering infrastructure, the futuristic grid is more prone to cyber-threats. The false data injection (FDI) attack is one of the most thoroughly researched cyber-attacks. Intelligently crafted, it can cause false estimation of states, which further seriously affects the entire power system operation. In this paper, we propose joint-transformation-based scheme to detect FDI attacks in real time. The proposed method is built on the dynamics of measurement variations. Kullback–Leibler distance is used to find out the difference between probability distributions obtained from measurement variations. The proposed method is tested using IEEE 14 bus system considering attack on different state variables. The results shows that the proposed scheme detects FDI attacks with high detection probability. [ABSTRACT FROM PUBLISHER]

False data injection (FDI) is considered to be one of the most dangerous cyber-attacks in smart grids, as it may lead to energy theft from end users, false dispatch in the distribution process, and device breakdown during power generation. In this paper, a novel kind of FDI attack, named tolerable false data injection (TFDI), is constructed. Such attacks exploit the traditional detector’s tolerance of observation errors to bypass the traditional bad data detection. Then, a method based on extended distributed state estimation (EDSE) is proposed to detect TFDI in smart grids. The smart grid is decomposed into several subsystems, exploiting graph partition algorithms. Each subsystem is extended outward to include the adjacent buses and tie lines, and generate the extended subsystem. The Chi-squares test is applied to detect the false data in each extended subsystem. Through decomposition, the false data stands out distinctively from normal observation errors and the detection sensitivity is increased. Extensive TFDI attack cases are simulated in the Institute of Electrical and Electronics Engineers (IEEE) 14-, 39-, 118- and 300-bus systems. Simulation results show that the detection precision of the EDSE-based method is much higher than that of the traditional method, while the proposed method significantly reduces the associated computational costs.

The accurately estimated state is of great importance for maintaining a stable running condition of power systems. To maintain the accuracy of the estimated state, bad data detection (BDD) is utilized by power systems to get rid of erroneous measurements due to meter failures or outside attacks. However, false data injection (FDI) attacks, as recently revealed, can circumvent BDD and insert any bias into the value of the estimated state. Continuous works on constructing and/or protecting power systems from such attacks have been done in recent years. This survey comprehensively overviews three major aspects: constructing FDI attacks; impacts of FDI attacks on electricity market; and defending against FDI attacks. Specifically, we first explore the problem of constructing FDI attacks, and further show their associated impacts on electricity market operations, from the adversary's point of view. Then, from the perspective of the system operator, we present countermeasures against FDI attacks. We also outline the future research directions and potential challenges based on the above overview, in the context of FDI attacks, impacts, and defense. [ABSTRACT FROM PUBLISHER]

This paper investigates the problem of defending against false data injection (FDI) attacks on power system state estimation. Although many research works have been previously reported on addressing the same problem, most of them made a very strong assumption that some meter measurements can be absolutely protected. To address the problem practically, a reasonable approach is to assume whether or not a meter measurement could be compromised by an adversary does depend on the defense budget deployed by the defender on the meter. From this perspective, our contributions focus on designing the least-budget defense strategy to protect power systems against FDI attacks. In addition, we also extend to investigate choosing which meters to be protected and determining how much defense budget to be deployed on each of these meters. We further formulate the meter selection problem as a mixed integer nonlinear programming problem, which can be efficiently tackled by Benders’ decomposition. Finally, extensive simulations are conducted on IEEE test power systems to demonstrate the advantages of the proposed approach in terms of computing time and solution quality, especially for large-scale power systems. [ABSTRACT FROM PUBLISHER]

An integral step for system operators in protecting modern distribution systems and smart cities against future cyberattacks is to primarily scrutinize complex cyberattack models targeting smart grids from the viewpoint of attackers. This paper proposes a cyberattack framework to result in simultaneous undervoltage and overvoltage in a smart distribution system equipped with renewable energy resources. In the upper level of the framework, attackers separately solve an optimization problem to result in optimal and suboptimal candidates of false data injection attack vectors leading to possible scenarios of under/overvoltage in the system. In the lower level, the attackers solve the second optimization problem collaboratively to identify the attacks targeting the most vulnerable regions of the system to undervoltage and overvoltage at the optimal time. In case the optimal time of attackers is not the same, a trade-off platform is designed within the framework such that they can compromise and identify a reasonable time for such a simultaneous cyberattack. [ABSTRACT FROM AUTHOR]

This paper focuses on low latency detection of cyberattacks in smart grids with deep reinforcement learning (DRL). The objective of low latency detection is to minimize detection delay while ensuring high detection accuracy. This is different from conventional detection methods that focus mainly on detection accuracy and pay little attention to detection delay. A lower detection delay can reduce recovery time, thus minimizing service interruption or economic losses due to cyberattacks. Since detection delay is the main design metric, the algorithm is developed by using a non-linear dynamic AC system model with an extended Kalman filter (EKF) to capture power grid state transitions in real-time, while many other works in the literature use a simplified linear DC model. The DRL detection algorithm is developed by using a continuous state space deep Q-network (DQN) on the framework of a Markov decision process (MDP). The new DQN design has two main innovations. First, the MDP state is designed as a sliding window of Rao-statistics of the AC dynamic state estimation residues. The proposed state formulation can accurately capture dynamic power state transitions in real-time. Second, a new reward function is designed to allow a flexible trade-off between detection delays and detection accuracy. The delay-accuracy trade-off can be adjusted by tuning a single parameter in the reward function. Simulation results show that the proposed DQN-based DRL detection algorithm can achieve very low detection delays with high detection accuracy. • A deep reinforcement learning based detection algorithm for cyberattack. • Capturing the real time grid state by AC dynamic state estimation. • A sliding window of Rao-statistics of the residues as the DQN state. • Minimizing ADD while maintaining low PFA by the trade-off parameter. [ABSTRACT FROM AUTHOR]