We present an analysis of a heuristic for abrupt change detection of systems with bounded state variations. The proposed analysis is based on the Singular Value Decomposition (SVD) of a history matrix built from system observations. We show that monitoring the largest singular value of the history matrix can be used as a heuristic for detecting abrupt changes in the system outputs. We provide sufficient detectability conditions for the proposed heuristic. As an application, we consider detecting malicious cyber data attacks on power systems and test our proposed heuristic on the IEEE 39-bus testbed.
@cite_4: We consider the problem of state-estimation of a linear dynamical system when some of the sensor measurements are corrupted by an adversarial attacker. The errors injected by the attacker in the sensor measurements can be arbitrary and are not assumed to follow a specific model (in particular they can be of arbitrary magnitude). We first characterize the number of attacked sensors that can be tolerated so that the state of the system can still be correctly recovered by any decoding algorithm. We then propose a specific computationally feasible decoding algorithm and we give a characterization of the number of errors this decoder can correct. For this we use ideas from compressed sensing and error correction over the reals and we exploit the dynamical nature of the problem. We show using numerical simulations that this decoder performs very well in practice and allows to correct a large number of errors.
@cite_7: In this paper, we study stealthy false-data attacksagainst state estimators in power networks. The focus ison applications in SCADA (Supervisory Control and DataAcquisition) systems where measurement data is corrupted bya malicious attacker. We introduce two security indices for thestate estimators. The indices quantify the least effort neededto achieve attack goals while avoiding bad-data alarms in thepower network control center (stealthy attacks). The indicesdepend on the physical topology of the power network and theavailable measurements, and can help the system operator toidentify sparse data manipulation patterns. This informationcan be used to strengthen the security by allocating encryptiondevices, for example. The analysis is also complemented witha convex optimization framework that can be used to evaluatemore complex attacks taking model deviations and multipleattack goals into account. The security indices are finallycomputed in an example. It is seen that a large measurementredundancy forces the attacker to use large magnitudes in thedata manipulation pattern, but that the pattern still can be relatively sparse.
@cite_8: Malicious data attacks to the real-time electricity market are studied. In particular, an adversary launches an attack by manipulating data from a set of meters with the goal of influencing revenues of a real-time market. The adversary must deal with the tradeoff between avoiding being detected by the control center and making maximum profit from the real time market. Optimal attacking strategy is obtained through an optimization of a quasi-concave objective function. It is shown that the probability of detection of optimal attack will always be less than 0.5. Attack performance is evaluated using simulations on the IEEE 14-bus system.
@cite_3: A power grid is a complex system connecting electric power generators to consumers through power transmission and distribution networks across a large geographical area. System monitoring is necessary to ensure the reliable operation of power grids, and state estimation is used in system monitoring to best estimate the power grid state through analysis of meter measurements and power system models. Various techniques have been developed to detect and identify bad measurements, including interacting bad measurements introduced by arbitrary, nonrandom causes. At first glance, it seems that these techniques can also defeat malicious measurements injected by attackers. In this article, we expose an unknown vulnerability of existing bad measurement detection algorithms by presenting and analyzing a new class of attacks, called false data injection attacks, against state estimation in electric power grids. Under the assumption that the attacker can access the current power system configuration information and manipulate the measurements of meters at physically protected locations such as substations, such attacks can introduce arbitrary errors into certain state variables without being detected by existing algorithms. Moreover, we look at two scenarios, where the attacker is either constrained to specific meters or limited in the resources required to compromise meters. We show that the attacker can systematically and efficiently construct attack vectors in both scenarios to change the results of state estimation in arbitrary ways. We also extend these attacks to generalized false data injection attacks, which can further increase the impact by exploiting measurement errors typically tolerated in state estimation. We demonstrate the success of these attacks through simulation using IEEE test systems, and also discuss the practicality of these attacks and the real-world constraints that limit their effectiveness.
@cite_0: We present a potential class of cyber attack, named false data injection attack, against the state estimation in deregulated electricity markets. With the knowledge of the system configuration, we show that such attacks will circumvent the bad data measurement detection equipped in present SCADA systems, and lead to profitable financial misconduct such as virtual bidding the ex-post locational marginal price (LMP). We demonstrate the potential attacks on an IEEE 14-bus system.
@cite_2: Future power networks will be characterized by safe and reliable functionality against physical malfunctions and cyber attacks. This paper proposes a unified framework and advanced monitoring procedures to detect and identify network components malfunction or measurements corruption caused by an omniscient adversary. We model a power system under cyber-physical attack as a linear time-invariant descriptor system with unknown inputs. Our attack model generalizes the prototypical stealth, (dynamic) false-data injection and replay attacks. We characterize the fundamental limitations of both static and dynamic procedures for attack detection and identification. Additionally, we design provably-correct (dynamic) detection and identification procedures based on tools from geometric control theory. Finally, we illustrate the effectiveness of our method through a comparison with existing (static) detection algorithms, and through a numerical study.
@cite_5: This paper demonstrates a novel optimization-based approach to estimating fault states in a DC power system. The model includes faults changing the circuit topology along with sensor faults. Our approach can be considered as a relaxation of the mixed estimation problem. We develop a linear model of the circuit and pose a convex problem for estimating the faults and other hidden states. A sparse fault vector solution is computed by using l 1 regularization. The solution is computed reliably and efficiently, and gives accurate diagnostics on the faults. We demonstrate a real-time implementation of the approach for an instrumented electrical power system testbed at NASA. Accurate estimates of multiple faults are computed in milliseconds on a PC. The approach performs well despite unmodeled transients and other modeling uncertainties present in the system.
@cite_15: State estimation is an important power system application that is used to estimate the state of the power transmission networks using (usually) a redundant set of sensor measurements and network topology information. Many power system applications such as contingency analysis rely on the output of the state estimator. Until recently it was assumed that the techniques used to detect and identify bad sensor measurements in state estimation can also thwart malicious sensor measurement modification. However, recent work by [1] demonstrated that an adversary, armed with the knowledge of network configuration, can inject false data into state estimation that uses DC power flow models without being detected. In this work, we explore the detection of false data injection attacks of [1] by protecting a strategically selected set of sensor measurements and by having a way to independently verify or measure the values of a strategically selected set of state variables. Specifically, we show that it is necessary and sufficient to protect a set of basic measurements to detect such attacks.
@cite_16: The problem of detecting and characterizing impacts of malicious attacks against smart grid state estimation is considered. Different from the classical bad data detection for state estimation, the detection of malicious data injected by an adversary must take into account carefully designed attacks capable of evading conventional bad data detection. A Bayesian framework is presented for the characterization of fundamental tradeoffs at the control center and for the adversary. For the control center, a detector based on the generalized likelihood ratio test (GRLT) is introduced and compared with conventional bad detection detection schemes. For the adversary, the tradeoff between increasing the mean square error (MSE) of the state estimation vs. the probability of being detected by the control center is characterized. A heuristic is presented for the design of worst attack.
@cite_13: Data injection attacks to manipulate system state estimators on power grids are considered. A unified formulation for the problem of constructing attacking vectors is developed for linearized measurement models. Based on this formulation, a new low-complexity attacking strategy is shown to significantly outperform naive l1 relaxation. It is demonstrated that it is possible to defend against malicious data injection if a small subset of measurements can be made immune to the attacks. However, selecting such subsets is a high-complexity combinatorial problem given the typically large size of electrical grids. To address the complexity issue, a fast greedy algorithm to select a subset of measurements to be protected is proposed. Another greedy algorithm that facilitates the placement of secure phasor measurement units (PMUs) to defend against data injection attacks is also developed. Simulations on the IEEE test systems demonstrate the benefits of the proposed algorithms.
@cite_12: Coordinated cyberattacks of power meter readings can be arranged to be undetectable by any bad data detection algorithm in the power system state estimation process. These unobservable attacks present a potentially serious threat to grid operations. Of particular interest are sparse attacks that involve the compromise of a modest number of meter readings. An efficient algorithm to find all unobservable attacks [under standard DC load flow approximations] involving the compromise of exactly two power injection meters and an arbitrary number of line power meters is presented. This requires O(n2m) flops for a power system with n buses and m line meters. If all lines are metered, there exist canonical forms that characterize all 3, 4, and 5-sparse unobservable attacks. These can be quickly detected in power systems using standard graph algorithms. Known-secure phasor measurement units [PMUs] can be used as countermeasures against an arbitrary collection of cyberattacks. Finding the minimum number of necessary PMUs is NP-hard. It is shown that p + 1 PMUs at carefully chosen buses are sufficient to neutralize a collection of p cyberattacks.
Recently, @cite_3 considered scenarios in which an attacker designs attacks carefully such that the conventional bad data detection algorithms are not capable of detecting them. Inspired by their work, many other papers targeted this problem @cite_3 @cite_4 @cite_2 @cite_12 @cite_16 @cite_13 @cite_5 @cite_15 @cite_7 . An adversary attack has an impact on the real-time and day-ahead electricity markets. Such situations have been studied by @cite_8 @cite_0 , among others.