False data injection attacks against state estimation in electric power grids

Anomaly detection technique for securing microgrid against false data attacks

The development of microgrid automation depends on information and communication technologies, which are vulnerable to cyber-attacks. Recent advancements in MGs enhance power systems' efficacy and reliability, but cybersecurity remains a significant concern, especially with false data injection attacks (FDIAs) posing serious threats. FDIAs can compromise measurement devices and tamper with State Estimation (SE), risking the seamless operation of MGs. To address this, this paper proposes an efficient Iterative Free Detection of False Data (IFDFD) scheme for detecting FDIAs in microgrid state estimation. The IFDFD scheme uses complex Micro Phasor Measurement Unit (μPMU) measurements and computes nodal power injections to detect FDIAs. Furthermore, the proposed scheme integrates an S-Estimator to eliminate noise errors caused by environmental factors and the component lifespan, making IFDFD robust against sophisticated attackers. The proposed IFDFD scheme has been tested and validated on the modified IEEE 14 bus test system, integrating Distributed Generations (DGs). False data was injected into the measurements to test the scheme's effectiveness. The efficacy of proposed IFDFD scheme has been validated by comparing it to existing method of FDIAs. The obtained result clearly validates the efficacy of the proposed IFDFD scheme.

Study of smart grid cyber-security, examining architectures, communication networks, cyber-attacks, countermeasure techniques, and challenges

Smart Grid (SG) technology utilizes advanced network communication and monitoring technologies to manage and regulate electricity generation and transport. However, this increased reliance on technology and connectivity also introduces new vulnerabilities, making SG communication networks susceptible to large-scale attacks. While previous surveys have mainly provided high-level overviews of SG architecture, our analysis goes further by presenting a comprehensive architectural diagram encompassing key SG components and communication links. This holistic view enhances understanding of potential cyber threats and enables systematic cyber risk assessment for SGs. Additionally, we propose a taxonomy of various cyberattack types based on their targets and methods, offering detailed insights into vulnerabilities. Unlike other reviews focused narrowly on protection and detection, our proposed categorization covers all five functions of the National Institute of Standards and Technology cybersecurity framework. This delivers a broad perspective to help organizations implement balanced and robust security. Consequently, we have identified critical research gaps, especially regarding response and recovery mechanisms. This underscores the need for further investigation to bolster SG cybersecurity. These research needs, among others, are highlighted as open issues in our concluding section.

A Brief Survey of Recent Advances and Methodologies for the Security Control of Complex Cyber-Physical Networks

Complex cyber-physical networks combine the prominent features of complex networks and cyber-physical systems (CPSs), and the interconnections between the cyber layer and physical layer usually pose significant impacts on its normal operation. Many vital infrastructures, such as electrical power grids, can be effectively modeled as complex cyber-physical networks. Given the growing importance of complex cyber-physical networks, the issue of their cybersecurity has become a significant concern in both industry and academic fields. This survey is focused on some recent developments and methodologies for secure control of complex cyber-physical networks. Besides the single type of cyberattack, hybrid cyberattacks are also surveyed. The examination encompasses both cyber-only hybrid attacks and coordinated cyber-physical attacks that leverage the strengths of both physical and cyber attacks. Then, special focus will be paid to proactive secure control. Reviewing existing defense strategies from topology and control perspectives aims to proactively enhance security. The topological design allows the defender to resist potential attacks in advance, while the reconstruction process can aid in reasonable and practical recovery from unavoidable attacks. In addition, the defense can adopt active switching-based control and moving target defense strategies to reduce stealthiness, increase the cost of attacks, and limit the attack impacts. Finally, conclusions are drawn and some potential research topics are suggested.

Security Analysis for Dynamic State Estimation of Power Systems With Measurement Delays

This article is centered on the cybersecurity research of dynamic state estimation for power systems with measurement delays. Relying on mixed measurements from phasor measurement units (PMUs) and remote terminal units (RTUs), a delayed measurement model is constructed. A modified state estimator based on the Kalman filter (KF) is designed, which can obtain the optimal estimated states under measurement delays. Moreover, the measurement data transmitted from the sensor to the estimator are vulnerable to cyberattacks. Especially, false data-injection (FDI) attacks are frequently encountered in the power system state estimation (PSSE) process. In the case of measurement delays, an FDI attack strategy is designed to interfere with the state estimator and evade detection by the chi-square detector. By utilizing the attacked estimated information and the uncorrupted measurement information, two measurement residual vectors are designed. According to these two residual vectors, a chi-square-based attack detection method is proposed, which has the ability to detect the attack without being affected by the delayed measurements. The proposed KF algorithm and attack detection method are implemented on an IEEE 14-bus system and they are confirmed to be effective and feasible.

Resilient Consensus Control for Multi-Agent Systems: A Comparative Survey

Due to the openness of communication network and the complexity of system structures, multi-agent systems are vulnerable to malicious network attacks, which can cause intense instability to these systems. This article provides a survey of state-of-the-art results of network attacks on multi-agent systems. Recent advances on three types of attacks, i.e., those on DoS attacks, spoofing attacks and Byzantine attacks, the three main network attacks, are reviewed. Their attack mechanisms are introduced, and the attack model and the resilient consensus control structure are discussed, respectively, in detail, in terms of the theoretical innovation, the critical limitations and the change of the application. Moreover, some of the existing results along this line are given in a tutorial-like fashion. In the end, some challenges and open issues are indicated to guide future development directions of the resilient consensus of multi-agent system under network attacks.

A Comprehensive Survey on Machine Learning-Based Intrusion Detection Systems for Secure Communication in Internet of Things

The Internet of Things (IoT) is a distributed system which is made up of the connections of smart objects (things) that can continuously sense the events in their sensing domain and transmit the data via the Internet. IoT is considered as the next revolution of the Internet since it has provided vast improvements in day-to-day activities of humans including the provision of efficient healthcare services and development of smart cities and intelligent transport systems. The IoT environment, by the application of suitable security mechanisms through efficient security management techniques, intrusion detection systems provide a wall of defence against the attacks on the Internet and on the devices connected with Internet by effective monitoring of the Internet traffic. Therefore, the intrusion detection system (IDS) is a resolution proposed by the researchers to monitor and secure the IoT communication. In this work, a meticulous analysis of the security of IoT networks based on quality-of-service metrics is performed for deploying intrusion detection systems by carrying out experiments on secured communication and measuring the network’s performance based on comparing them with the existing security metrics. Finally, we propose a new and effective IDS using a deep learning-based classification approach, namely, fuzzy CNN, for improving the security of communication. The major and foremost advantages of this system include an upsurge in detection accuracy, the accurate detection of denial of service (DoS) attacks more efficiently, and the reduction of false positive rates.

Distributed Optimal and Self-Tuning Filters Based on Compressed Data for Networked Stochastic Uncertain Systems with Deception Attacks

In this study, distributed security estimation problems for networked stochastic uncertain systems subject to stochastic deception attacks are investigated. In sensor networks, the measurement data of sensor nodes may be attacked maliciously in the process of data exchange between sensors. When the attack rates and noise variances for the stochastic deception attack signals are known, many measurement data received from neighbour nodes are compressed by a weighted measurement fusion algorithm based on the least-squares method at each sensor node. A distributed optimal filter in the linear minimum variance criterion is presented based on compressed measurement data. It has the same estimation accuracy as and lower computational cost than that based on uncompressed measurement data. When the attack rates and noise variances of the stochastic deception attack signals are unknown, a correlation function method is employed to identify them. Then, a distributed self-tuning filter is obtained by substituting the identified results into the distributed optimal filtering algorithm. The convergence of the presented algorithms is analyzed. A simulation example verifies the effectiveness of the proposed algorithms.

Joint Adversarial Example and False Data Injection Attacks for State Estimation in Power Systems

Although state estimation using a bad data detector (BDD) is a key procedure employed in power systems, the detector is vulnerable to false data injection attacks (FDIAs). Substantial deep learning methods have been proposed to detect such attacks. However, deep neural networks are susceptible to adversarial attacks or adversarial examples, where slight changes in inputs may lead to sharp changes in the corresponding outputs in even well-trained networks. This article introduces the joint adversarial example and FDIAs (AFDIAs) to explore various attack scenarios for state estimation in power systems. Considering that perturbations added directly to measurements are likely to be detected by BDDs, our proposed method of adding perturbations to state variables can guarantee that the attack is stealthy to BDDs. Then, malicious data that are stealthy to both BDDs and deep learning-based detectors can be generated. Theoretical and experimental results show that our proposed state-perturbation-based AFDIA method (S-AFDIA) can carry out attacks stealthy to both conventional BDDs and deep learning-based detectors, while our proposed measurement-perturbation-based adversarial FDIA method (M-AFDIA) succeeds if only deep learning-based detectors are used. The comparative experiments show that our proposed methods provide better performance than state-of-the-art methods. Besides, the ultimate effect of attacks can also be optimized using the proposed joint attack methods.

Observability Decomposition-Based Decentralized Kalman Filter and Its Application to Resilient State Estimation under Sensor Attacks

This paper considers a discrete-time linear time invariant system in the presence of Gaussian disturbances/noises and sparse sensor attacks. First, we propose an optimal decentralized multi-sensor information fusion Kalman filter based on the observability decomposition when there is no sensor attack. The proposed decentralized Kalman filter deploys a bank of local observers who utilize their own single sensor information and generate the state estimate for the observable subspace. In the absence of an attack, the state estimate achieves the minimum variance, and the computational process does not suffer from the divergent error covariance matrix. Second, the decentralized Kalman filter method is applied in the presence of sparse sensor attacks as well as Gaussian disturbances/noises. Based on the redundant observability, an attack detection scheme by the χ2 test and a resilient state estimation algorithm by the maximum likelihood decision rule among multiple hypotheses, are presented. The secure state estimation algorithm finally produces a state estimate that is most likely to have minimum variance with an unbiased mean. Simulation results on a motor controlled multiple torsion system are provided to validate the effectiveness of the proposed algorithm.

Vector Auto-Regression-Based False Data Injection Attack Detection Method in Edge Computing Environment

With the wide application of advanced communication and information technology, false data injection attack (FDIA) has become one of the significant potential threats to the security of smart grid. Malicious attack detection is the primary task of defense. Therefore, this paper proposes a method of FDIA detection based on vector auto-regression (VAR), aiming to improve safe operation and reliable power supply in smart grid applications. The proposed method is characterized by incorporating with VAR model and measurement residual analysis based on infinite norm and 2-norm to achieve the FDIA detection under the edge computing architecture, where the VAR model is used to make a short-term prediction of FDIA, and the infinite norm and 2-norm are utilized to generate the classification detector. To assess the performance of the proposed method, we conducted experiments by the IEEE 14-bus system power grid model. The experimental results demonstrate that the method based on VAR model has a better detection of FDIA compared to the method based on auto-regressive (AR) model.

Detection Scheme for Tampering Behavior on Distributed Controller of Electric-Thermal Integrated Energy System Based on Relation Network

In recent years, with the development of smart grid, the power systems and other energy systems are gradually forming integrated energy systems. The electric-thermal integrated energy system is a mature integrated energy system at present. The electric-thermal integrated energy system uses modern communication technology to realize the comprehensive regulation of electric energy and thermal energy, which greatly improves the efficiency of energy use. However, this also greatly increases the risk of malicious tampering with the energy dispatch system. In this paper, we study the regulation of electric-thermal integrated energy systems considering false data injection attacks. First, we establish a compromised model of an electric-thermal integrated energy system considering false data injection attacks. Then, we designed vulnerable variable observers for different tampering scenarios to observe the tampered variables. Finally, considering the relationship between the observed data and the measured data, we design a tampering behavior detection method based on relation network. The simulation results verify the effectiveness of the detection method proposed in this paper.

Event-based fuzzy resilient control of nonlinear DC Microgrids under denial-of-service attacks

This paper focuses on designing an event-triggered fuzzy resilient controller for networked nonlinear DC microgrid (MG) with constant power loads (CPLs) in the presence of denial-of-service (DoS) attacks. First, an attack-resilient event-triggered communication scheme is introduced to reduce the communication overhead of the DC MG while achieving the desired performance despite the presence of the DoS attacks. Second, the nonlinear event-triggered DC MG system with CPLs is modeled as a T-S fuzzy system with artificial delay through the sector nonlinearity approach combined with time-delay system modeling method. Then, by employing the noncontinuous piecewise Lyapunov-Krasovskii functional (NPLKF) approach, the asymptotic stability criterion of the built event-triggered T-S fuzzy DC MG is obtained in the form of linear matrix inequalities (LMIs), and a design method of fuzzy controller is proposed. Finally, case studies are presented to validate the efficiency of our proposed method.

Secure predictor-based neural dynamic surface control of nonlinear cyber-physical systems against sensor and actuator attacks

This paper addresses a secure predictor-based neural dynamic surface control (SPNDSC) issue for a cyber-physical system in a nontriangular form suffering from both sensor and actuator deception attacks. To avoid the algebraic loop problem, only partial states are employed as input vectors of neural networks (NNs) for approximating unknown dynamics, and compensation terms are further developed to offset approximation errors from NNs. With introduction of nonlinear gain functions and attack compensators, adverse effects of an intelligent adversary are alleviated effectively. Furthermore, we present stability analysis and prove the ultimate boundedness of all signals in the closed-loop system. The effectiveness of the proposed control strategy is illustrated by two examples.

Real-Time Locational Detection of Stealthy False Data Injection Attack in Smart Grid: Using Multivariate-Based Multi-Label Classification Approach

Recently, false data injection attacks (FDIAs) have been identified as a significant category of cyber-attacks targeting smart grids’ state estimation and monitoring systems. These cyber-attacks aim to mislead control system operations by compromising the readings of various smart grid meters. The real-time and precise locational identification of FDIAs is crucial for smart grid security and reliability. This paper proposes a multivariate-based multi-label locational detection (MMLD) mechanism to detect the presence and locations of FDIAs in real-time measurements with precise locational detection accuracy. The proposed architecture is a parallel structure that concatenates Long Short-Term Memory (LSTM) with Temporal Convolutional Neural Network (TCN). The proposed architecture is trained using Keras with Tensorflow libraries, and its performance is verified using an IEEE standard bus system in the MATPOWER package. Extensive testing has shown that the proposed approach effectively improves the presence-detection accuracy for locating stealthy FDIAs in small and large systems under various attack conditions. In addition, this work provides a customized loss function for handling the class imbalance problem. Simulation results reveal that our MMLD technique has a modest advantage in some aspects. First, our mechanism outperforms benchmark models because the problem is formulated as a multivariate-based multi-label classification problem. Second, it needs fewer iterations for training and reaching the optimal model. More specifically, our approach is less complex and more scalable than benchmark algorithms.

Detection and Prevention of False Data Injection Attacks in the Measurement Infrastructure of Smart Grids

The smart grid has become a cyber-physical system and the more cyber it becomes, the more prone it is to cyber-attacks. One of the most important cyber-attacks in smart grids is false data injection (FDI) into its measurement infrastructure. This attack could manipulate the control center in a way to execute wrong control actions on various generating units, causing system instabilities that could ultimately lead to power system blackouts. In this study, a novel false data detection and prevention paradigm was proposed for the measurement infrastructure in smart grids. Two techniques were devised to manage cyber-attacks, namely, the fixed dummy value model and the variable dummy value model. Limitations of the fixed dummy value model were identified and addressed in the variable dummy value model. Both methods were tested on an IEEE 14 bus system and it was shown through the results that an FDI attack that easily bypassed the bad data filter of the state estimator was successfully identified by the fixed dummy model. Second, attacks that were overlooked by the fixed dummy model were identified by the variable dummy method. In this way, the power system was protected from FDI attacks.

Detecting Cyberattacks on Electrical Storage Systems through Neural Network Based Anomaly Detection Algorithm

Distributed Energy Resources (DERs) are growing in importance Power Systems. Battery Electrical Storage Systems (BESS) represent fundamental tools in order to balance the unpredictable power production of some Renewable Energy Sources (RES). Nevertheless, BESS are usually remotely controlled by SCADA systems, so they are prone to cyberattacks. This paper analyzes the vulnerabilities of BESS and proposes an anomaly detection algorithm that, by observing the physical behavior of the system, aims to promptly detect dangerous working conditions by exploiting the capabilities of a particular neural network architecture called the autoencoder. The results show the performance of the proposed approach with respect to the traditional One Class Support Vector Machine algorithm.

False Data Injection Detection for Phasor Measurement Units

Cyber-threats are becoming a big concern due to the potential severe consequences of such threats is false data injection (FDI) attacks where the measures data is manipulated such that the detection is unfeasible using traditional approaches. This work focuses on detecting FDIs for phasor measurement units where compromising one unit is sufficient for launching such attacks. In the proposed approach, moving averages and correlation are used along with machine learning algorithms to detect such attacks. The proposed approach is tested and validated using the IEEE 14-bus and the IEEE 30-bus test systems. The proposed performance was sufficient for detecting the location and attack instances under different scenarios and circumstances.

Reachability-Based False Data Injection Attacks and Defence Mechanisms for Cyberpower System

With the push for higher efficiency and reliability, an increasing number of intelligent electronic devices (IEDs) and associated information and communication technology (ICT) are integrated into the Internet of Things (IoT)-enabled smart grid. These advanced technologies and IEDs also bring potential vulnerabilities to the intelligent cyber–physical smart grid. State estimation, as a primary step of system monitoring and situational awareness, is a potential target for attackers. A number of other smart grid applications, such as voltage stability assessment and contingency screening, utilize state estimation results as input data. False data injection (FDI) is a specific way to attack state estimation by manipulating input data. Existing research mainly focuses on the mathematical analysis of FDI attacks; however, in these methods, discussions of reachability requirements to compromise measurements considering cyberinfrastructure are limited. Reachability is defined as a measure that estimates the number of hosts to compromise for the possible FDI. Most of the existing FDI attack methods require the simultaneous manipulation on multiple measurement devices in different substations, in order to bypass the bad data detection, which may be impractical. In this paper, a new type of reachability-based FDI attack considering the cybernetwork with a practical attack is proposed and validated on two IEEE test systems. The corresponding defence mechanisms are (a) decentralized state estimation (DSE), (b) DSE with additional backup computational nodes, (c) communication network rerouting, and (d) intrusion detection system, and they were developed and presented with validation for two IEEE test systems with superior performance for an IoT-enabled intelligent smart grid system.

Earth-Mover-Distance-Based Detection of False Data Injection Attacks in Smart Grids

The high integration of power information physical system improves the efficiency of power transmission, but it also brings new threats to power grid. False data injection attacks can use traditional bad data to detect vulnerabilities and maliciously tamper with measurement data to affect the state estimation results. In order to achieve a higher security level for power systems, we propose an earth mover distance method to detect false data injection attacks in smart grids. The proposed method is built on the dynamic correlation of measurement data between adjacent moments. Firstly, a joint-image-transformation-based scheme is proposed to preprocess the measurement data variation, so that the distribution characteristics of measurement data variation are more significant. Secondly, the deviation between the probability distribution of measurement data variation and the histogram are obtained based on the earth’s mover distance. Finally, a reasonable detection threshold is selected to judge whether there are false data injection attacks. The proposed method is tested using IEEE 14 bus system considering the state variable attacks on different nodes. The results verified that the proposed method has a high detection accuracy against false data injection attacks.

Digital Twin—Cyber Replica of Physical Things: Architecture, Applications and Future Research Directions

The Internet of Things (IoT) connects massive smart devices to collect big data and carry out the monitoring and control of numerous things in cyber-physical systems (CPS). By leveraging machine learning (ML) and deep learning (DL) techniques to analyze the collected data, physical systems can be monitored and controlled effectively. Along with the development of IoT and data analysis technologies, a number of CPS (smart grid, smart transportation, smart manufacturing, smart cities, etc.) adopt IoT and data analysis technologies to improve their performance and operations. Nonetheless, directly manipulating or updating the real system has inherent risks. Thus, creating a digital clone of a real physical system, denoted as a Digital Twin (DT), is a viable strategy. Generally speaking, a DT is a data-driven software and hardware emulation platform, which is a cyber replica of physical systems. Meanwhile, a DT describes a specific physical system and tends to achieve the functions and use cases of physical systems. Since DT is a complex digital system, finding a way to effectively represent a variety of things in timely and efficient manner poses numerous challenges to the networking, computing, and data analytics for IoT. Furthermore, the design of a DT for IoT systems must consider numerous exceptional requirements (e.g., latency, reliability, safety, scalability, security, and privacy). To address such challenges, the thoughtful design of DTs offers opportunities for novel and interdisciplinary research efforts. To address the aforementioned problems and issues, in this paper, we first review the architectures of DTs, data representation, and communication protocols. We then review existing efforts on applying DT into IoT data-driven smart systems, including the smart grid, smart transportation, smart manufacturing, and smart cities. Further, we summarize the existing challenges from CPS, data science, optimization, and security and privacy perspectives. Finally, we outline possible future research directions from the perspectives of performance, new DT-driven services, model and learning, and security and privacy.

Cyberattacks identification in IEC 61850 based substation using proximal support vector machine

Maintaining the reliable, efficient, secure and multifunctional IEC 61850 based substation is an extremely challenging task, especially in the ever-evolving cyberattacks domain. This challenge is also exacerbated with expending the modern power system (MPS) to meet the demand along with growing availability of hacking tools in the hacker community. Few of the most serious threats in the substation automation system (SAS) are DoS (Denial of Services), MS (Message Suppression) and DM (Data Manipulation) attacks, where DoS is due to flood bogus frames. In MS, hacker inject the GOOSE sequence (sqNum) and GOOSE status (stNum) number. In the DM attacks, attacker modify current measurements reported by the merging units, inject modified boolean value of circuit breaker and replay a previously valid message. In this paper, an intelligent cyberattacks identification approach in IEC 61850 based SAS using PSVM (proximal support vector machine) is proposed. The performance of the proposed approach is demonstrated using experimental dataset of recorded signatures. The obtained results of the demonstrated study shows the effectiveness and high level of acceptability for real side implementation to protect the SAS from the cyberattacks in different scenarios.

Data-Driven False Data-Injection Attack Design and Detection in Cyber-Physical Systems

In this article, a data-driven design scheme of undetectable false data-injection attacks against cyber-physical systems is proposed first, with the aid of the subspace identification technique. Then, the impacts of undetectable false data-injection attacks are evaluated by solving a constrained optimization problem, with the constraints of undetectability and energy limitation considered. Moreover, the detection of designed data-driven false data-injection attacks is investigated via the coding theory. Finally, the simulations on the model of a flight vehicle are illustrated to verify the effectiveness of the proposed methods.

Effective Energy Management via False Data Detection Scheme for the Interconnected Smart Energy Hub–Microgrid System under Stochastic Framework

During the last few years, attention has overwhelmingly focused on the integrated management of urban services and the demand of customers for locally-based supply. The rapid growth in developing smart measuring devices has made the underlying systems more observable and controllable. This exclusive feature has led the system designers to pursue the implementation of complex protocols to provide faster services based on data exchanges. On the other hand, the demands of consumers for locally-based supply could cause a disjunction and islanding behavior that demands to be dealt with by precise action. At first, keeping a centralization scheme was the main priority. However, the advent of distributed systems opened up new solutions. The operation of distributed systems requires the implementation of strong communication links to boost the existing infrastructure via smart control and supervision, which requires a foundation and effective investigations. Hence, necessary actions need to be taken to frustrate any disruptive penetrations into the system while simultaneously benefiting from the advantages of the proposed smart platform. This research addresses the detection of false data injection attacks (FDIA) in energy hub systems. Initially, a multi-hub system both in the presence of a microgrid (the interconnected smart energy hub-based microgrid system) and without it has been modeled for energy management in a way that allows them to cooperate toward providing energy with each other. Afterward, an FDIA is separately exerted to all three parts of the energy carrier including the thermal, water, and electric systems. In the absence of FDIA detection, the impact of FDIA is thoroughly illustrated on energy management, which considerably contributes to non-optimal operation. In the same vein, the intelligent priority selection based reinforcement learning (IPS-RL) method is proposed for FDIA detection. In order to model the uncertainty effects, the unscented transformation (UT) is applied in a stochastic framework. The results on the IEEE standard test system validate the system’s performance.

Cybersecurity in Power Grids: Challenges and Opportunities

Increasing volatilities within power transmission and distribution force power grid operators to amplify their use of communication infrastructure to monitor and control their grid. The resulting increase in communication creates a larger attack surface for malicious actors. Indeed, cyber attacks on power grids have already succeeded in causing temporary, large-scale blackouts in the recent past. In this paper, we analyze the communication infrastructure of power grids to derive resulting fundamental challenges of power grids with respect to cybersecurity. Based on these challenges, we identify a broad set of resulting attack vectors and attack scenarios that threaten the security of power grids. To address these challenges, we propose to rely on a defense-in-depth strategy, which encompasses measures for (i) device and application security, (ii) network security, and (iii) physical security, as well as (iv) policies, procedures, and awareness. For each of these categories, we distill and discuss a comprehensive set of state-of-the art approaches, as well as identify further opportunities to strengthen cybersecurity in interconnected power grids.

Cyber Risks to Critical Smart Grid Assets of Industrial Control Systems

Cybersecurity threats targeting industrial control systems (ICS) have significantly increased in the past years. Moreover, the need for users/operators to understand the consequences of attacks targeting these systems and protect all assets is vital. This work explores asset discovery in ICS and how to rank these assets based on their criticality. This paper also discusses asset discovery and its components. We further present existing solutions and tools for asset discovery. We implement a method to identify critical assets based on their connection and discuss related results and evaluation. The evaluation utilises four attack scenarios to stress the importance of protecting these critical assets since the failure to protect them can lead to serious consequences. Using a 12-bus system case, our results show that targeting such a system can increase and overload transmission lines values to 120% and 181% MVA, which can affect the power supply and disrupt service, and it can increase the cost up to 60%, affecting the productivity of this electric grid.

Analysis of false data injection attacks in power systems: A dynamic Bayesian game-theoretic approach

False data injection (FDI) attack is a malicious kind of cyber attack that targets state estimators of power systems. In this paper, a dynamic Bayesian game-theoretic approach is proposed to analyze FDI attacks with incomplete information. In this approach, players' payoffs are identified according to a proposed bi-level optimization model, and the prior belief of the attacker's type is constantly updated based on history profiles and relationships between measurements. It is proven that the type belief and Bayesian Nash equilibrium are convergent. The stability and reliability of this approach can be guaranteed by the law of large numbers and the central limit theorem. The time complexity and space complexity are O(n_mn_sn_l) and O(1), respectively. Numerical results show that the average success rate to identify at-risk load measurements is 98%. The defender can efficiently allocate resources to at-risk load measurements using the dynamic Bayesian game-theoretic approach.

A Network Parameter Database False Data Injection Correction Physics-Based Model: A Machine Learning Synthetic Measurement-Based Approach

Concerning power systems, real-time monitoring of cyber–physical security, false data injection attacks on wide-area measurements are of major concern. However, the database of the network parameters is just as crucial to the state estimation process. Maintaining the accuracy of the system model is the other part of the equation, since almost all applications in power systems heavily depend on the state estimator outputs. While much effort has been given to measurements of false data injection attacks, seldom reported work is found on the broad theme of false data injection on the database of network parameters. State-of-the-art physics-based model solutions correct false data injection on network parameter database considering only available wide-area measurements. In addition, deterministic models are used for correction. In this paper, an overdetermined physics-based parameter false data injection correction model is presented. The overdetermined model uses a parameter database correction Jacobian matrix and a Taylor series expansion approximation. The method further applies the concept of synthetic measurements, which refers to measurements that do not exist in the real-life system. A machine learning linear regression-based model for measurement prediction is integrated in the framework through deriving weights for synthetic measurements creation. Validation of the presented model is performed on the IEEE 118-bus system. Numerical results show that the approximation error is lower than the state-of-the-art, while providing robustness to the correction process. Easy-to-implement model on the classical weighted-least-squares solution, highlights real-life implementation potential aspects.

A Novel Technique to Detect False Data Injection Attacks on Phasor Measurement Units

The power industry is in the process of grid modernization with the introduction of phasor measurement units (PMUs), advanced metering infrastructure (AMI), and other technologies. Although these technologies enable more reliable and efficient operation, the risk of cyber threats has increased, as evidenced by the recent blackouts in Ukraine and New York. One of these threats is false data injection attacks (FDIAs). Most of the FDIA literature focuses on the vulnerability of DC estimators and AC estimators to such attacks. This paper investigates FDIAs for PMU-based state estimation, where the PMUs are comparable. Several states can be manipulated by compromising one PMU through the channels of that PMU. A Phase Locking Value (PLV) technique was developed to detect FDIAs. The proposed approach is tested on the IEEE 14-bus and the IEEE 30-bus test systems under different scenarios using a Monte Carlo simulation where the PLV demonstrated an efficient performance.

Advancements and Research Trends in Microgrids Cybersecurity

Microgrids are growing in importance in the Smart Grid paradigm for power systems. Microgrid security is becoming crucial since these systems increasingly rely on information and communication technologies. Many technologies have been proposed in the last few years for the protection of industrial control systems, ranging from cryptography, network security, security monitoring systems, and innovative control strategies resilient to cyber-attacks. Still, electrical systems and microgrids present their own peculiarities, and some effort has to be put forth to apply cyber-protection technologies in the electrical sector. In the present work, we discuss the latest advancements and research trends in the field of microgrid cybersecurity in a tutorial form.

Attack Categorisation for IoT Applications in Critical Infrastructures, a Survey

With the ever advancing expansion of the Internet of Things (IoT) into our everyday lives, the number of attack possibilities increases. Furthermore, with the incorporation of the IoT into Critical Infrastructure (CI) hardware and applications, the protection of not only the systems but the citizens themselves has become paramount. To do so, specialists must be able to gain a foothold in the ongoing cyber attack war-zone. By organising the various attacks against their systems, these specialists can not only gain a quick overview of what they might expect but also gain knowledge into the specifications of the attacks based on the categorisation method used. This paper presents a glimpse into the area of IoT Critical Infrastructure security as well as an overview and analysis of attack categorisation methodologies in the context of wireless IoT-based Critical Infrastructure applications. We believe this can be a guide to aid further researchers in their choice of adapted categorisation approaches. Indeed, adapting appropriated categorisation leads to a quicker attack detection, identification, and recovery. It is, thus, paramount to have a clear vision of the threat landscapes of a specific system.

State-of-the-Art of Optimal Active and Reactive Power Flow: A Comprehensive Review from Various Standpoints

Optimal power flow (OPF), a mathematical programming problem extending power flow relationships, is one of the essential tools in the operation and control of power grids. To name but a few, the primary goals of OPF are to meet system demand at minimum production cost, minimum emission, and minimum voltage deviation. Being at the heart of power system problems for half a century, the OPF can be split into two significant categories, namely optimal active power flow (OAPF) and optimal reactive power flow (ORPF). The OPF is spontaneously a complicated non-linear and non-convex problem; however, it becomes more complex by considering different constraints and restrictions having to do with real power grids. Furthermore, power system operators in the modern-day power networks implement new limitations to the problem. Consequently, the OPF problem becomes more and more complex which can exacerbate the situation from mathematical and computational standpoints. Thus, it is crucially important to decipher the most appropriate methods to solve different types of OPF problems. Although a copious number of mathematical-based methods have been employed to handle the problem over the years, there exist some counterpoints, which prevent them from being a universal solver for different versions of the OPF problem. To address such issues, innovative alternatives, namely heuristic algorithms, have been introduced by many researchers. Inasmuch as these state-of-the-art algorithms show a significant degree of convenience in dealing with a variety of optimization problems irrespective of their complexities, they have been under the spotlight for more than a decade. This paper provides an extensive review of the latest applications of heuristic-based optimization algorithms so as to solve different versions of the OPF problem. In addition, a comprehensive review of the available methods from various dimensions is presented. Reviewing about 200 works is the most significant characteristic of this paper that adds significant value to its exhaustiveness.

A Bi-Level Model for Detecting and Correcting Parameter Cyber-Attacks in Power System State Estimation

Power system state estimation is an important component of the status and healthiness of the underlying electric power grid real-time monitoring. However, such a component is prone to cyber-physical attacks. The majority of research in cyber-physical power systems security focuses on detecting measurements False-Data Injection attacks. While this is important, measurement model parameters are also a most important part of the state estimation process. Measurement model parameters though, also known as static-data, are not monitored in real-life applications. Measurement model solutions ultimately provide estimated states. A state-of-the-art model presents a two-step process towards simultaneous false-data injection security: detection and correction. Detection steps are χ2 statistical hypothesis test based, while correction steps consider the augmented state vector approach. In addition, the correction step uses an iterative solution of a relaxed non-linear model with no guarantee of optimal solution. This paper presents a linear programming method to detect and correct cyber-attacks in the measurement model parameters. The presented bi-level model integrates the detection and correction steps. Temporal and spatio characteristics of the power grid are used to provide an online detection and correction tool for attacks pertaining the parameters of the measurement model. The presented model is implemented on the IEEE 118 bus system. Comparative test results with the state-of-the-art model highlight improved accuracy. An easy-to-implement model, built on the classical weighted least squares solution, without hard-to-derive parameters, highlights potential aspects towards real-life applications.

An Artificial Intelligence Empowered Cyber Physical Ecosystem for Energy Efficiency and Occupation Health and Safety

Reducing energy waste is one of the primary concerns facing Remote Industrial Plants (RIP) and, in particular, the accommodations and operational plants located in remote areas. With the COVID-19 pandemic continuing to attack the health of workforce, managing the balance between energy efficiency and Occupation Health and Safety (OHS) in the workplace becomes another great challenge for the RIP. Maintaining this balance is difficult mainly because a full awareness of the OHS will generally consume more energy while reducing the energy cost may lead to a less effective OHS, and the existing literature has not seen a system that is designed for the RIPs to conserve energy usage and improve workforce OHS simultaneously. To bridge this gap, in this paper, we propose an AI Empowered Cyber Physical Ecosystem (AECPE) solution for the RIPs, which integrates Cyber-Physical Systems (CPS), artificial intelligence, and mobile networks. The preliminary results of lab experiments and field tests proved that the AECPE was able to help industries reduce the corporate annual energy cost that is worth millions of dollars, optimise the environmental conditions, and improve OHS for all workers and stakeholders. The implementation of the AECPE can result in efficient energy usage, reduced wastage and emissions, environment-friendly operations, and improved social reputation of the industries.

A Deep Learning-Based Classification Scheme for False Data Injection Attack Detection in Power System

A smart grid improves power grid efficiency by using modern information and communication technologies. However, at the same time, due to the dependence on information technology and the deep integration of electrical components and computing information in cyber space, the system might become increasingly vulnerable to cyber-attacks. Among various emerging security problems, a false data injection attack (FDIA) is a new type of attack against the state estimation. In this article, a deep learning-based identification scheme is developed to detect and mitigate information corruption. The scheme implements a conditional deep belief network (CDBN) to analyze time-series input data and leverages captured features to detect the FDIA. The performance of our detection mechanism is validated by using the IEEE 14-bus test system for simulation. Different attack scenarios and parameters are set to demonstrate the feasibility and effectiveness of the developed scheme. Compared with the artificial neural network (ANN) and the support vector machine (SVM), the experimental analyses indicate that the results of our detection mechanism are better than those of the other two in terms of FDIA detection accuracy and robustness.

Towards Secure Fog Computing: A Survey on Trust Management, Privacy, Authentication, Threats and Access Control

Fog computing is an emerging computing paradigm that has come into consideration for the deployment of Internet of Things (IoT) applications amongst researchers and technology industries over the last few years. Fog is highly distributed and consists of a wide number of autonomous end devices, which contribute to the processing. However, the variety of devices offered across different users are not audited. Hence, the security of Fog devices is a major concern that should come into consideration. Therefore, to provide the necessary security for Fog devices, there is a need to understand what the security concerns are with regards to Fog. All aspects of Fog security, which have not been covered by other literature works, need to be identified and aggregated. On the other hand, privacy preservation for user’s data in Fog devices and application data processed in Fog devices is another concern. To provide the appropriate level of trust and privacy, there is a need to focus on authentication, threats and access control mechanisms as well as privacy protection techniques in Fog computing. In this paper, a survey along with a taxonomy is proposed, which presents an overview of existing security concerns in the context of the Fog computing paradigm. Moreover, the Blockchain-based solutions towards a secure Fog computing environment is presented and various research challenges and directions for future research are discussed.