On Reliability Analysis of Smart Grids under Topology Attacks

In this paper, we consider false data injection (FDI) attacks with limited information of transmission-line susceptances and new countermeasures in smart grids. First, we prove that the adversary could launch FDI attacks to modify the state variable on a bus or superbus only if he/she knows the susceptance of every transmission line that is incident to that bus or superbus. Based on this observation, we provide a new countermeasure against FDI attacks, i.e., to make the susceptances of n-1 interconnected transmission lines that cover all buses unknown to the adversary (e.g., by proactively perturbing transmission-line susceptances through distributed flexible AC transmission system (D-FACTS) devices), where n is the total number of buses. This new countermeasure can work alone or in conjunction with traditional ones to reduce the number of meter measurements/state variables that are to be secured against FDI attacks. The implementation of FDI attacks with limited susceptance information and the effectiveness of new countermeasures are demonstrated by using an illustrative 4-bus power system and the IEEE 9-bus, 14-bus, 30-bus, 118-bus, and 300-bus test power systems.

In the recent years, cyberattacks to smart grids are becoming more frequent. Among the many malicious activities that can be launched against smart grids, the False Data Injection (FDI) attacks have raised significant concerns from both academia and industry. FDI attacks can affect the (internal) state estimation process—critical for smart grid monitoring and control—thus being able to bypass conventional Bad Data Detection (BDD) methods. Hence, prompt detection and precise localisation of FDI attacks are becoming of paramount importance to ensure smart grids security and safety. Several papers recently started to study and analyse this topic from different perspectives and address existing challenges. Data‐driven techniques and mathematical modelling are the major ingredients of the proposed approaches. The primary objective is to provide a systematic review and insights into FDI attacks joint detection and localisation approaches considering that other surveys mainly concentrated on the detection aspects without detailed coverage of localisation aspects. For this purpose, more than 40 major research contributions were selected and inspected, while conducting a detailed analysis of the methodology and objectives in relation to the FDI attacks detection and localisation. Key findings of the identified papers were provided according to different criteria, such as employed FDI attacks localisation techniques, utilised evaluation scenarios, investigated FDI attack types, application scenarios, adopted methodologies and the use of additional data. Finally, open issues and future research directions were discussed.

The pervasiveness of information and communications technologies as well as intelligent electronic devices leads to an expanded attack surface in smart grids, making it increasingly challenging to withstand the high-profile false data injection (FDI) attacks. In this paper, we propose a Proactive Approach to Mitigate FDI Attacks (PAMA) in smart grids. With PAMA scheme, the critical information - power grid connections and configurations as well as the original measurement data - used for constructing FDI attacks is well protected from leakage or theft, so that FDI attacks are effectively mitigated. Specifically, we transform the state estimation and FDI detection application into a distributed one equipped with converted information from the critical information provided by the control center. In addition, the original measurement data is also protected by using a secure hybrid Paillier cryptosystem. Our PAMA scheme is proved to be secure and effective in mitigating FDI attacks on smart grids. The computational complexity and the communication overhead are evaluated on the standard IEEE 14-bus test system. Keywords <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">__</sup> Smart grids, false data injection (FDI) attack, Paillier cryptosystem, state estimation.

The work presented in this chapter is an extension of our previous research of bringing together the Cognitive Dynamic System (CDS) and the Smart Grid (SG) by focusing on AC state estimation and Cyber-Attack detection. Under the AC power flow model, state estimation is complex and computationally expensive as it relies on iterative procedures. On the other hand, the False Data Injection (FDI) attacks are a new category of cyber-attacks targeting the SG that can bypass the current bad data detection techniques in the SG. Due to the complexity of the nonlinear system involved, the amount of published works on AC based FDI attacks have been fewer compared to their DC counterpart. Here, we will demonstrate how the entropic state, which is the objective function of the CDS, can be used as a metric to monitor the grid’s health and detect FDI attacks. The CDS, acting as the supervisor of the system, improves the entropic state on a cycle to cycle basis by dynamically optimizing the state estimation process through the reconfiguration of the weights of the sensors in the network. In order to showcase performance of this new structure, computer simulations are carried out on the IEEE 14-bus system for optimal state estimation and FDI attack detection.

The integration of information and communication technologies (ICTs) has provided modern smart grids, such as direct current (DC) microgrids (MGs), with various advantages, e.g., the possibility of large-scale integration of renewable energy sources and complex control schemes. This extensive deployment of ICTs, however, makes DC MGs prone to a variety of cyber threats, e.g., false data injection (FDI) attacks. On this basis, this paper develops online detection and mitigation schemes to counter FDI attacks against DC MGs. Initially, in the offline training of the detection scheme, the density-based spatial clustering of applications with noise (DBSCAN) method is used for extracting prescriptive features of DC MG measurements and clustering them in healthy and under-attack operations under several uncertainties in DC MG operations. These features are used to train an adaptive network-based fuzzy inference system (ANFIS) architecture for the online identification of FDI attacks. Afterward, the trained ANFIS is used to detect FDI attacks and obtain the attack vectors benefiting from the real-time measurements estimated by an optimal state observer. Finally, an adaptive model predictive controller (AMPC) is developed to update the power-sharing commands—and mitigate the FDI attack—using the ANFIS’s obtained attack vectors. The effectiveness of the proposed framework is evaluated for several realistic FDI attack scenarios and different uncertainties. To show the scalability of the proposed detection and mitigation methods, a DC MG with eight converters is also studied in the presence of FDI attacks and uncertainties using real-time simulations.

The introduction of information and communication technologies makes network environments increasingly open, leaving smart-grid control systems incredibly vulnerable to malicious attacks. False data injection (FDI) attacks stealthily tamper with measurement data, resulting in erroneous decisions made by the control center that greatly influence the normal operation of the power system. By taking advantage of real-time data acquisition with edge computing, in this article, we propose a scheme based on classification of predicted residuals (CPRs) for the FDI attack detection. The CPR scheme first predicts the acquired measurement data at the edge of the sensing network via developing an accurate prediction model. Followed the novel real-time classification method under the edge devices supporting, it classifies the predicted residuals independent of the false data to enhance the detection accuracy. Through these two steps, the detection rate of FDI attacks is greatly improved. The proposed scheme is validated in a real microgrid testbed. Experimental results show that the CPR scheme performs well in detecting FDI attacks and remains sensitive in injection attack probability and magnitude. The detection scheme even has effectiveness at low injection attack probability and magnitude (5% and 0.018 per thousand, respectively). Furthermore, it also proves that the proposed scheme has applicability in high real-time requirements at the edge of smart grids.

The smart grid combines the classical power system with the information technology, leading to a cyber-physical system. In such an environment, the malicious injection of data has the potential to cause severe consequences. Classical residual-based methods for bad data detection are unable to detect well designed false data injection (FDI) attacks. Moreover, most of the works on FDI attack detection are based on the linearized DC model of the power system and fails to detect attacks based on the AC model. The aim of this paper is to address these problems by using the graph structure of the grid and the AC power flow model. We derive an attack detection method that is able to detect previously undetectable FDI attacks. This method is based on concepts originating from graph signal processing (GSP). The proposed detection scheme calculates the graph Fourier transform of an estimated grid state and filters the graph’s high-frequency components. By comparing the maximum norm of this outcome with a threshold, we can detect the presence of FDI attacks. Case studies on the IEEE 14-bus system demonstrate that the proposed method is able to detect a wide range of previously undetectable attacks, both on angles and on magnitudes of the voltages.

Man‐in‐The‐Middle (MiTM) attacks present numerous threats to a smart grid. In a MiTM attack, an intruder embeds itself within a conversation between two devices to either eavesdrop or impersonate one of the devices, making it appear to be a normal exchange of information. Thus, the intruder can perform false data injection (FDI) and false command injection (FCI) attacks that can compromise power system operations, such as state estimation, economic dispatch, and automatic generation control (AGC). Very few researchers have focused on MiTM methods that are difficult to detect within a smart grid. To address this, we are designing and implementing multi‐stage MiTM intrusions in an emulation‐based cyber‐physical power system testbed against a large‐scale synthetic grid model to demonstrate how such attacks can cause physical contingencies such as misguided operation and false measurements. MiTM intrusions create FCI, FDI, and replay attacks in this synthetic power grid. This work enables stakeholders to defend against these stealthy attacks, and we present detection mechanisms that are developed using multiple alerts from intrusion detection systems and network monitoring tools. Our contribution will enable other smart grid security researchers and industry to develop further detection mechanisms for inconspicuous MiTM attacks.

A new cyber-security approach for load frequency control of hybrid interconnected renewable power systems

A quickest intrusion detection algorithm is proposed to detect false data injection attacks (FDIAs) in smart grids with time-varying dynamic models. The quickest detection algorithm aims at minimizing the worst case detection delays (WDDs) of cyberattacks, subject to an upper bound of the false alarm rate. Since power-grid state transitions could be caused by either cyberattacks or sudden change in loads or grid configurations, we propose to distinguish between an FDIA and a sudden system change by using a time-varying dynamic model, which can accurately capture the dynamic state transitions due to changes in system configurations. A dynamic state estimation algorithm is developed to estimate and track the time-varying and nonstationary power-grid states. The quickest detection algorithm is developed by analyzing the statistical properties of dynamic state estimations, such that the algorithm minimizes the WDD while accurately distinguishing FDIA from sudden system changes. A Markov-chain-based analytical model is used to identify the detector&#x2019;s parameter and quantify its performance. Simulation results demonstrate that the proposed algorithm can accurately detect and remove false data injections or system faults with minimum delays. The proposed algorithm can be implemented to harden intelligent electronic devices (IEDs) or supervisory control and data acquisition (SCADA) systems to improve their resilience to cyberattacks or system faults, thus improving the cybersecurity of smart grids.

The cybersecurity of the smart grid is becoming a critical issue to the power systems. Mitigating potential cyberattacks on the control of the power electronic devices is an important concern in the controller design to enhance the resilience of the overall power grid. In this paper, a novel model predictive control (MPC) is proposed for the multilevel cascaded H-bridge inverters considering the false data injection (FDI) attacks. The FDI attack is a vicious attack scenario when the attack signals are injected into the sensors in the cyberphysical systems (CPS). It is shown that FDI signals can effectively penetrate the commonly used Kalman Filter (KF) based state estimation and jeopardize the control of the inverters. The k-Nearest Neighbors (KNN) algorithm is employed in the proposed scheme to mitigate the FDI attacks. The proposed KNN-based MPC scheme was tested with various types of attack signals. The results show that the proposed scheme exhibits a robust performance in the face of the malicious FDI attacks.

Machine learning (ML)-based intrusion detection system (IDS) approaches have been significantly applied and advanced the state-of-the-art system security and defense mechanisms. In smart grid computing environments, security threats have been significantly increased as shared networks are commonly used, along with the associated vulnerabilities. However, compared to other network environments, ML-based IDS research in a smart grid is relatively unexplored, although the smart grid environment is facing serious security threats due to its unique environmental vulnerabilities. In this article, we conducted an extensive survey on ML-based IDS in smart grids based on the following key aspects: (1) The applications of the ML-based IDS in transmission and distribution side power components of a smart power grid by addressing its security vulnerabilities; (2) dataset generation process and its usage in applying ML-based IDSs in the smart grid; (3) a wide range of ML-based IDSs used by the surveyed papers in the smart grid environment; (4) metrics, complexity analysis, and evaluation testbeds of the IDSs applied in the smart grid; and (5) lessons learned, insights, and future research directions.

False data injection attacks (FDIA) are a main category of cyber-attacks threatening the security of power systems. Contrary to the detection of these attacks, less attention has been paid to identifying the attacked units of the grid. To this end, this work jointly studies detecting and localizing the stealth FDIA in power grids. Exploiting the inherent graph topology of power systems as well as the spatial correlations of measurement data, this paper proposes an approach based on the graph neural network (GNN) to identify the presence and location of the FDIA. The proposed approach leverages the auto-regressive moving average (ARMA) type graph filters (GFs) which can better adapt to sharp changes in the spectral domain due to their rational type filter composition compared to the polynomial type GFs such as Chebyshev. To the best of our knowledge, this is the first work based on GNN that automatically detects and localizes FDIA in power systems. Extensive simulations and visualizations show that the proposed approach outperforms the available methods in both detection and localization of FDIA for different IEEE test systems. Thus, the targeted areas can be identified and preventive actions can be taken before the attack impacts the grid.

Dear editor, The existing bad data detection (BDD) cannot effectively detect false data injection attacks (FDIAs) in smart grid. The objectiveness of this letter is to investigate a novel dynamic watermarking (DW)-based extended Kalman filter (EKF) detection method to detect FDIAs. Firstly, security weakness of traditional <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\chi^{2}$</tex> detector is analyzed, and a novel DW-based EKF detection method is proposed for FDIAs. Secondly, the detection effectiveness and security property of the proposed method are analyzed theoretically, where not only the positive correlation between the detection performance and DW signal intensity but also zero impact of FDIAs not being detected on smart grid (SG) are revealed. Finally, the effectiveness of the proposed method is confirmed by experimental results.

Smart grids (SGs) are becoming increasingly complex with the integration of communication, protection, and automation technologies. However, this digital transformation has introduced new vulnerabilities, especially false data injection attacks (FDIAs) and Denial of Service (DoS) attacks. FDIAs can subtly corrupt measurement data, misleading operators without triggering traditional bad data detection (BDD) methods in state estimation (SE), while DoS attacks disrupt the availability of sensor data, affecting grid observability. This paper presents a deep learning-based framework for detecting and localizing FDIAs, including under DoS conditions. A hybrid CNN, Transformer, and BiLSTM model captures spatial, global, and temporal correlations to forecast measurements and detect anomalies using a threshold-based approach. For further detection and localization, a Multi-layer Perceptron (MLP) model maps forecast errors to the compromised sensor locations, effectively complementing or replacing BDD methods. Unlike conventional SE, the approach is fully data-driven and does not require knowledge of grid topology. Experimental evaluation on IEEE 14–bus and 118–bus systems demonstrates strong performance for the FDIA condition, including precision of 0.9985, recall of 0.9980, and row-wise accuracy (RACC) of 0.9670 under simultaneous FDIA and DoS conditions. Furthermore, the proposed method outperforms existing machine learning models, showcasing its potential for real-time cybersecurity and situational awareness in modern SGs.