Geo-spatial Screening using Anomaly Detection for Efficient Security Analysis of V2X Sensor Data on C-ITS Service

False data injection (FDI) attacks are malicious insertions of false data as sensor measurements in a cyber-physical system, in order to lead the system to take a wrong action. False data injection attacks do not attack the computational or network components of cyber-physical systems but the interface between the physical and the cyber part. Such attacks are powerful and can have catastrophic results. Defense against them can be achieved by limiting the attack surface through vulnerability analysis of the cyber-physical system design and by monitoring system operation in the field with monitors that observe system parameters and sensor measurements and detect abnormal operation early. In this chapter, we describe promising techniques for vulnerability analysis and dynamic monitoring, based on efficient SMT solvers and Kalman filter techniques, respectively.

The introduction of information and communication technologies makes network environments increasingly open, leaving smart-grid control systems incredibly vulnerable to malicious attacks. False data injection (FDI) attacks stealthily tamper with measurement data, resulting in erroneous decisions made by the control center that greatly influence the normal operation of the power system. By taking advantage of real-time data acquisition with edge computing, in this article, we propose a scheme based on classification of predicted residuals (CPRs) for the FDI attack detection. The CPR scheme first predicts the acquired measurement data at the edge of the sensing network via developing an accurate prediction model. Followed the novel real-time classification method under the edge devices supporting, it classifies the predicted residuals independent of the false data to enhance the detection accuracy. Through these two steps, the detection rate of FDI attacks is greatly improved. The proposed scheme is validated in a real microgrid testbed. Experimental results show that the CPR scheme performs well in detecting FDI attacks and remains sensitive in injection attack probability and magnitude. The detection scheme even has effectiveness at low injection attack probability and magnitude (5% and 0.018 per thousand, respectively). Furthermore, it also proves that the proposed scheme has applicability in high real-time requirements at the edge of smart grids.

Anomaly detection technique for securing microgrid against false data attacks

This paper mainly studies vector-related learning and pairwise optimization feature selection for false data injection attack detection in smart grid. In order to provide experimental detection of false data injection attacks, this article will conduct a detailed analysis of the power system segmentation. This paper comprehensively considers the similarity of nodes, security control and confidentiality strategies to complete the optimal partition. Next, we preprocess the measurement data. In order to improve the adaptability of the algorithm structure to the grid structure and further improve the accuracy and convergence speed of the algorithm output, a differential evolution algorithm with swarm intelligence is proposed. Obtain a higher-precision state estimate useful for detecting bad data. In the experiment of this article, if false data account for 20% of all data, the detection accuracy exceeds 75%. As the number of experimental groups increases, the detection accuracy of only one type of false data that does not meet the rules will continue to increase, but the detection accuracy of other types of false data will not change much, but the overall detection accuracy will become higher. Experimental results show that the detection framework can not only effectively detect and identify false data injection attacks on multiple bus nodes, but also has high detection accuracy and can effectively recover false data.

False data injection (FDI) attack is a hot topic in cyber-physical systems (CPSs). Attackers inject bad data into sensors or return false data to the controller to cause the inaccurate state estimation. Although there exists many detection approaches, such as bad data detector (BDD), sequence pattern mining, and machine learning methods, a smart attacker still can inject perfectly false data to go undetected. In this paper, we focus on the advanced false data injection (AFDI) attack and its detection method. An AFDI attack refers to the attack where a malicious entity accurately and successively changes sensory data, making the normal system state continuously evaluated as other legal system states, causing wrong outflow of controllers. The attack can lead to an automatic and long-term system failure/performance degradation. We first depict the AFDI attack model and analyze limitations of existing detectors for detecting AFDI. Second, we develop an approach based on machine learning, which utilizes the k-Nearest Neighbor (KNN) technique and heterogeneous data including sensory data and system commands to implement a classifier for detecting AFDI attacks. Finally, simulation experiments are given to demonstrate AFDI attack impact and the effectiveness of the proposed method for detecting AFDI attacks.

A new cyber-security approach for load frequency control of hybrid interconnected renewable power systems

Cooperative Intelligent Transport Systems (C-ITS) have seen increased interest in recent years, with several ongoing activities and first practical implementations. While clearly V2X-communication will play a significant role in all C-ITS deployments, several key components, such as the wireless communication technology and the message formats, are still evolving. This calls for a modular approach when designing C-ITS infrastructure, especially when considering a real world urban environment. Such environments are characterized by heterogeneous traffic light hardware and traffic management systems.This paper focuses on the modular architecture of the C-ITS pilot in Dresden. For example, a highly flexible communication stack is developed for this special purpose. It fully supports the message types standardized by European Telecommunications Standards Institute (ETSI) on the one hand, while on the other hand allowing the rapid implementation and test of novel message types and contents. This went hand in hand with the development of a modular roadside unit, enabling the rapid implementation of service applications on its central processing unit. In combination with a cloud-based backend, a real-time C-ITS service platform with a hybrid communication concept is developed.This paper presents a modular architecture and best practice guidelines based on experiences of the C-ITS pilot in Dresden. First results of research topics, such as latency measurements, are shown.The ongoing C-ITS deployment in Dresden is part of the initiative Synchrone Mobilitat 2023, which aims at advancing Intelligent Transport Systems. Focusing on automated and connected driving in urban areas, the research and development projects under its umbrella initiate scientific and technological developments and provide comprehensive test facilities. Automated and connected driving in urban areas requires not only simulations and test drives on test sites but also enormous testing effort under real traffic conditions. The Dresden Testbed offers outstanding conditions to conduct real-world test with a multitude of test kilometers and the experience of different traffic scenarios.

In the recent years, cyberattacks to smart grids are becoming more frequent. Among the many malicious activities that can be launched against smart grids, the False Data Injection (FDI) attacks have raised significant concerns from both academia and industry. FDI attacks can affect the (internal) state estimation process—critical for smart grid monitoring and control—thus being able to bypass conventional Bad Data Detection (BDD) methods. Hence, prompt detection and precise localisation of FDI attacks are becoming of paramount importance to ensure smart grids security and safety. Several papers recently started to study and analyse this topic from different perspectives and address existing challenges. Data‐driven techniques and mathematical modelling are the major ingredients of the proposed approaches. The primary objective is to provide a systematic review and insights into FDI attacks joint detection and localisation approaches considering that other surveys mainly concentrated on the detection aspects without detailed coverage of localisation aspects. For this purpose, more than 40 major research contributions were selected and inspected, while conducting a detailed analysis of the methodology and objectives in relation to the FDI attacks detection and localisation. Key findings of the identified papers were provided according to different criteria, such as employed FDI attacks localisation techniques, utilised evaluation scenarios, investigated FDI attack types, application scenarios, adopted methodologies and the use of additional data. Finally, open issues and future research directions were discussed.

This paper studies the cooperative output regulation problem for heterogeneous multi‐agent systems (MASs) subject to false data injection (FDI) attacks, which means the malicious cyber‐attackers may inject false data into the communication topology randomly. To ensure that each follower agent can track the leader agent accurately, we construct both an observer and a control law for each follower agent. Since the FDI attacks may exist in the communication network, a filter with an adaptive compensator, which can estimate attack signals dynamically, is equipped for each observer, such that the filter can neutralize attacks when malicious attackers launch attacks. Therefore, the cooperative output regulation can be achieved under the control law based on the observer no matter whether there exist attacks or not. Finally, a numerical example is provided for validating the theoretical results.

False data injection (FDI) attacks have recently been introduced as an important class of cyber-attacks against power system state estimation. Utilizing vulnerabilities in information systems, attackers can inject well-constructed false data and stealthily misguide results of state estimation. However, only measurements, such as power flows and bus injections, are coordinately modified in FDI attacks, which may result in a larger number of modified measurements in constructing such attacks. In this article, we propose a network parameter coordinated false data injection (NP-FDI) attack to reduce the number of attacked measurements, where expected changes of system states and modifications of network parameters are well coordinated. Analysis of minimal attack set at a single line gives feasible conditions in reducing the number of attacked measurements. A sparse attack strategy is designed to obtain the minimal attack set of the whole grid, which can also be applied to cases with incomplete topology information. An extension to NP-FDI attacks with incomplete line impedance is presented, where the required line impedance can be estimated from local measurements adjacent to the targeted branch. Based on simulations in the IEEE 14-bus and IEEE 118-bus test systems, performance of the proposed NP-FDI attacks on sparsity and stealth are evaluated.

This brief considers the distributed finite-time consensus tracking control problem for nonlinear multi-agent systems with false data injection (FDI) attacks. Firstly, since instability is inevitable when false datas are injected into the researched system, a security control algorithm combining the modified coordinate transformation and the dynamic surface control (DSC) method is developed to eliminate the negative impact of FDI attacks and reduce the burden caused by iterative computations of virtual controls. Besides, there are unknown nonlinearities in the dynamics of each agent, which can not be directly handled by the traditional control design. Thus, the neural-network-based approximation technique is introduced to compensate the unknown nonlinearities. In summary, a novel controller is constructed for each agent, which guarantees the consensus of the outputs of all agents can be achieved and that all the signals of the studied system are bounded within a finite-time period. To prove the correctness of the designed security control algorithm, a simulation example of the multi-agent system composed of multiple single-link robots is presented.

An Amalgamated Novel IDS Model for Misbehaviour Detection using VeReMiNet

ABSTRACTAs a result of the rapid growth of distributed state estimation in modern power systems, power networks are facing increasingly serious security problems, thus requiring the advancement of defense techniques against cyber attacks. This paper is devoted to investigating distributed consensus state estimation with a defense mechanism against false data injection (FDI) attacks for power systems. By introducing a transformation matrix, the local subsystem model associated with the mixed remote terminal unit and phasor measurement unit measurements is constructed. Taking into account historical estimation information on state variables without being attacked, a defense mechanism constructed by secure historical estimation value is presented to protect the estimator against FDI attacks while maintaining accuracy in estimation. Then a distributed Kalman consensus filter (DKCF) is hosted to estimate the dynamic states of power systems under FDI attack protector. Considering scalability in large‐scale power systems, a suboptimal DKCF with the designed protector is developed. By means of the Lyapunov‐based approach, a sufficient condition is provided to ensure that the proposed estimator equipped with the defense mechanism is stable. Finally, the proposed distributed state estimation algorithms are validated on an IEEE benchmark 14‐bus power system.

Secure control against cyber attacks becomes increasingly significant in cyber-physical systems (CPSs). False data injection attacks are a class of cyber attacks that aim to compromise CPS functions by injecting false data such as sensor measurements and control signals. For quantified false data injection attacks, this paper establishes an effective defense framework from the energy conversion perspective. Then, we design an energy controller to dynamically adjust the system energy changes caused by unknown attacks. The designed energy controller stabilizes the attacked CPSs and ensures the dynamic performance of the system by adjusting the amount of damping injection. Moreover, with the L <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sub> disturbance attenuation technique, the burden of control system design is simplified because there is no need to design an attack observer. In addition, this secure control method is simple to implement because it avoids complicated mathematical operations. The effectiveness of our control method is demonstrated through an industrial CPS that controls a permanent magnet synchronous motor.

This work proposes a local-global fuzzy-clustering feature extraction scheme for detecting False Data Injection Attacks (FDIA). In this scheme, the data undergo several pre-processing steps including missing values imputation based on the local and global fuzzy-clustering correlation approach. There are four main components of the proposed method: i) data acquisition, ii) standardization, iii) normalization, and iv) imputation. To evaluate the performance of this scheme, the NGSIM dataset (described below) was used. This dataset contains data acquired from the environment using a set of sensors that collect data from the neighboring vehicles. The results show that the accuracy of models trained using said features extracted by the proposed scheme was higher than those proposed by the related studies. This indicates that the local-global fuzzy clustering data imputation approach proposed by this study can estimate the missing values better than existing techniques based on an exhaustive literature review.