The advent of smart power grid which plays a vital role in the upcoming smart city era is accompanied with the implementation of a monitoring tool, called state estimation. For the case of the unbalanced residential distribution grid, the state estimating operation which is conducted at a regional scale is considered as an application of the edge computing-based Internet of Things (IoT). While the outcome of the state estimation is important to the subsequent control activities, its accuracy heavily depends on the data integrity of the information collected from the scattered measurement devices. This fact exposes the vulnerability of the state estimation module under the effect of data-driven attacks. Among these, false data injection attack (FDI) is attracting much attention due to its capability to interfere with the normal operation of the network without being detected. This paper presents an attack design scheme based on a nonlinear physical-constraint model that is able to produce an FDI attack with theoretically stealthy characteristic. To demonstrate the effectiveness of the proposed design scheme, simulations with the IEEE 13-node test feeder and the WSCC 9-bus system are conducted. The experimental results indicate that not only the false positive rate of the bad data detection mechanism is 100 per cent but the physical consequence of the attack is severe. These results pose a serious challenge for operators in maintaining the integrity of measurement data.
Smart Grid has rapidly transformed the centrally controlled power system into a massively interconnected cyber-physical system that benefits from the revolutions happening in the communications (e.g. 5G) and the growing proliferation of the Internet of Things devices (such as smart metres and intelligent electronic devices). While the convergence of a significant number of cyber-physical elements has enabled the Smart Grid to be far more efficient and competitive in addressing the growing global energy challenges, it has also introduced a large number of vulnerabilities culminating in violatio…
As an important cyber-physical system (CPS), smart grid is highly vulnerable to cyber attacks. Amongst various types of attacks, false data injection attack (FDIA) proves to be one of the top-priority cyber-related issues and has received increasing attention in recent years. However, so far little attention has been paid to privacy preservation issues in the detection of FDIAs in smart grid. Inspired by federated learning, a FDIA detection method based on secure federated deep learning is proposed in this paper by combining Transformer, federated learning and Paillier cryptosystem. The Transf…
With the increasing use of information and communication technology in electrical power grids, the security of energy supply is increasingly threatened by cyber-attacks. Traditional cyber-security measures, such as firewalls or intrusion detection/prevention systems, can be used as mitigation and prevention measures, but their effective use requires a deep understanding of the potential threat landscape and complex attack processes in energy information systems. Given the complexity and lack of detailed knowledge of coordinated, timed attacks in smart grid applications, we need information and…
Modern advances in sensor, computing, and communication technologies enable various smart grid applications. The heavy dependence on communication technology has highlighted the vulnerability of the electricity grid to false data injection (FDI) attacks that can bypass bad data detection mechanisms. Existing mitigation in the power system either focus on redundant measurements or protect a set of basic measurements. These methods make specific assumptions about FDI attacks, which are often restrictive and inadequate to deal with modern cyber threats. In the proposed approach, a deep learning b…
Smart grid monitoring, automation and control will completely rely on PMU based sensor data soon. Accordingly, a high throughput, low latency Information and Communication Technology (ICT) infrastructure should be opted in this regard. Due to the low cost, low power profile, dynamic nature, improved accuracy and scalability, wireless sensor networks (WSNs) can be a good choice. Yet, the efficiency of a WSN depends a lot on the network design and the routing technique. In this paper a new design of the ICT network for smart grid using WSN is proposed. In order to understand the interactions bet…
In this paper a new class of cyber attacks against state estimation in the electric power grid is considered. This class of attacks is named false data injection attacks. We show that with the knowledge of the system configuration an attacker could successfully inject false data into certain state variable while bypassing existing techniques for bad data detection. In the preliminary section we consider the feasibility of such an attack and the necessary condition to successfully avoid detection. After that we show that with the knowledge of the system configuration, certain line flow measurem…
The false data injection (FDI) attack cannot be detected by the traditional anomaly detection techniques used in the energy system state estimators. In this paper, we demonstrate how FDI attacks can be constructed blindly, i.e., without system knowledge, including topological connectivity and line reactance information. Our analysis reveals that existing FDI attacks become detectable (consequently unsuccessful) by the state estimator if the data contains grossly corrupted measurements such as device malfunction and communication errors. The proposed sparse optimization based stealthy attacks c…
Texas A&M University（德克萨斯A&M大学）；Arkansas State University（阿肯色州立大学）；Tennessee Tech University（田纳西理工大学）
False data injection attacks (FDIA) are a main category of cyber-attacks threatening the security of power systems. Contrary to the detection of these attacks, less attention has been paid to identifying the attacked units of the grid. To this end, this work jointly studies detecting and localizing the stealth FDIA in power grids. Exploiting the inherent graph topology of power systems as well as the spatial correlations of measurement data, this paper proposes an approach based on the graph neural network (GNN) to identify the presence and location of the FDIA. The proposed approach leverages…
State estimation is of considerable significance for the power system operation and control. However, well-designed false data injection attacks can utilize blind spots in conventional residual-based bad data detection methods to manipulate measurements in a coordinated manner and thus affect the secure operation and economic dispatch of grids. In this paper, we propose a detection approach based on an autoencoder neural network. By training the network on the dependencies intrinsic in 'normal' operation data, it effectively overcomes the challenge of unbalanced training data that is inherent …
Tampering of metering infrastructure of an electrical distribution system can significantly cause customers' billing discrepancy. The large-scale deployment of smart meters may potentially be tampered by malware by propagating their agents to other IP-based meters. Such a possibility is to pivot through the physical perimeters of a smart meter. While this framework may help utilities to accurately energy consumption information on the regular basis, it is challenging to identify malicious meters when there is a large number of users that are exploited to vulnerability and kWh information being…
Design and Implementation of a Secure RAG-Enhanced AI Chatbot for Smart Tourism Customer Service: Defending Against Prompt Injection Attacks -- A Case Study of Hsinchu, Taiwan
Department of Information Management, National Dong Hwa University（信息管理系，国立东华大学）；By The Student (BTS) Experimental Education Program (Non-School Type)（学生（BTS）实验教育计划（非学校类型））
Automated Vulnerability Injection in Smart Contracts Using Large Language Models
Università degli Studi di Napoli Federico II（那不勒斯费德里科二世大学）；Gran Sasso Science Institute (GSSI)（格兰萨索科学研究所）；University of Coimbra（科英布拉大学）；College of Computing and Informatics, University of North Carolina at Charlotte（北卡罗来纳大学夏洛特分校计算与信息学院）
Zhejiang University of Technology（浙江工业大学）；Nanyang Technological University（南洋理工大学）；Zhejiang University（浙江大学）
Most traditional false data injection attack (FDIA) detection approaches rely on a key assumption, i.e., the power system can be accurately modeled. However, the transmission line parameters are dynamic and cannot be accurately known during operation and thus the involved modeling errors should not be neglected. In this paper, an illustrative case has revealed that modeling errors in transmission lines significantly weaken the detection effectiveness of conventional FDIA approaches. To tackle this issue, we propose an FDIA detection mechanism from the perspective of transfer learning. Specific…
With the proliferation of smart devices and revolutions in communications, electrical distribution systems are gradually shifting from passive, manually-operated and inflexible ones, to a massively interconnected cyber-physical smart grid to address the energy challenges of the future. However, the integration of several cutting-edge technologies has introduced several security and privacy vulnerabilities due to the large-scale complexity and resource limitations of deployments. Recent research trends have shown that False Data Injection (FDI) attacks are becoming one of the most malicious cyb…
Security becomes an extremely important issue in smart grid. To maintain the steady operation for smart power grid, massive measurement devices must be allocated widely among the power grid. Previous studies are focused on false data injection attack to the smart grid system. In practice, false data injection attack is not easy to implement, since it is not easy to hack the power grid data communication system. In this paper, we demonstrate that a novel time stamp attack is a practical and dangerous attack scheme for smart grid. Since most of measurement devices are equipped with global positi…
University of New South Wales（新南威尔士大学）；Sun Yat-sen University（中山大学）
Recent studies have demonstrated that smart grids are vulnerable to stealthy false data injection attacks (SFDIAs), as SFDIAs can bypass residual-based bad data detection mechanisms. The SFDIA detection has become one of the focuses of smart grid research. Methods based on deep learning technology have shown promising accuracy in the detection of SFDIAs. However, most existing methods rely on the temporal structure of a sequence of measurements but do not take account of the spatial structure between buses and transmission lines. To address this issue, we propose a spatiotemporal deep network,…
Rapid urbanization calls for smart traffic management solutions that incorporate sensors, distributed traffic controllers and V2X communication technologies to provide fine-grained traffic control to mitigate congestion. As in many other cyber-physical systems, smart traffic management systems typically lack security measures. This allows numerous opportunities for adversarial entities to craft attacks on the sensor networks, wireless data sharing and/or the distributed traffic controllers. We show that such vulnerabilities can be exploited to disrupt mobility in a large urban area and cause u…
The growing adoption of voice-enabled devices (e.g., smart speakers), particularly in smart home environments, has introduced many security vulnerabilities that pose significant threats to users' privacy and safety. When multiple devices are connected to a voice assistant, an attacker can cause serious damage if they can gain control of these devices. We ask where and how can an attacker issue clean voice commands stealthily across a physical barrier, and perform the first academic measurement study of this nature on the command injection attack. We present the BarrierBypass attack that can be…
PromptShield Home: Ambient Multimodal Prompt Injection Defense for Smart-Home Agents
The Pennsylvania State University（宾夕法尼亚州立大学）；Chang’an University（长安大学）；Beijing Normal University（北京师范大学）；Carnegie Mellon University（卡内基梅隆大学）；University of Edinburgh（爱丁堡大学）；Tsinghua University（清华大学）
Man-in-The-Middle (MiTM) attacks present numerous threats to a smart grid. In a MiTM attack, an intruder embeds itself within a conversation between two devices to either eavesdrop or impersonate one of the devices, making it appear to be a normal exchange of information. Thus, the intruder can perform false data injection (FDI) and false command injection (FCI) attacks that can compromise power system operations, such as state estimation, economic dispatch, and automatic generation control (AGC). Very few researchers have focused on MiTM methods that are difficult to detect within a smart gri…
The smart features of modern cars are enabled by a number of Electronic Control Units (ECUs) components that communicate through an in-vehicle network, known as Controller Area Network (CAN) bus. The fundamental challenge is the security of the communication link where an attacker can inject messages (e.g., increase the speed) that may impact the safety of the driver. Developing an effective defensive security solution depends on the knowledge of the identity of the ECUs, which is proprietary information. This paper proposes a message injection attack detection mechanism that is independent of…
The proposed smart contract can prevent seven cyber attacks, such as Denial of Service (DoS), Man in the Middle Attack (MITM), Distributed Denial of Service (DDoS), 51\%, Injection attacks, Routing Attack, and Eclipse attack. The Delegated Proof of Stake (DPoS) consensus algorithm used in this model reduces the number of validators for each transaction which makes it suitable for lightweight applications. The timing complexity of key/certificate validation and signature/certificate revocation processes do not depend on the number of transactions. The comparisons of various timing parameters wi…
The evolution of the traditional power system towards the modern smart grid has posed many new cybersecurity challenges to this critical infrastructure. One of the most dangerous cybersecurity threats is the False Data Injection (FDI) attack, especially when it is capable of completely bypassing the widely deployed Bad Data Detector of State Estimation and interrupting the normal operation of the power system. Most of the simulated FDI attacks are designed using simplified linearized DC model while most industry standard State Estimation systems are based on the nonlinear AC model. In this pap…
Physically accessible devices such as sensor nodes in Wireless Sensor Networks or "smart" devices in the Internet of Things have to be resistant to a broad spectrum of physical attacks, for example to Side Channel Analysis and to Fault Injection attacks. In this work we concentrate on the vulnerability of ASICs to precise optical Fault Injection attacks. Here we propose to use metal fillers as potential low-cost countermeasure that may be effective against a broad spectrum of physical attacks. In our future work we plan to evaluate different methods of metal fillers placement, to select an eff…
Modern electric power grid, known as the Smart Grid, has fast transformed the isolated and centrally controlled power system to a fast and massively connected cyber-physical system that benefits from the revolutions happening in the communications and the fast adoption of Internet of Things devices. While the synergy of a vast number of cyber-physical entities has allowed the Smart Grid to be much more effective and sustainable in meeting the growing global energy challenges, it has also brought with it a large number of vulnerabilities resulting in breaches of data integrity, confidentiality …
Smart grid (SG) systems enhance grid resilience and efficient operation, leveraging the bidirectional flow of energy and information between generation facilities and prosumers. For energy demand management (EDM), the SG network requires computing a large amount of data generated by massive Internet-of-things sensors and advanced metering infrastructure (AMI) with minimal latency. This paper proposes a deep reinforcement learning (DRL)-based resource allocation scheme in a 6G-enabled SG edge network to offload resource-consuming EDM computation to edge servers. Automatic resource provisioning …
For a safe and reliable operation of the smart grid, timely detection of cyber-attacks is of critical importance. Moreover, considering smarter and more capable attackers, robust detection mechanisms are needed against a diverse range of cyber-attacks. With these purposes, we propose a robust online detection algorithm for (possibly combined) false data injection (FDI) and jamming attacks, that also provides online estimates of the unknown and time-varying attack parameters and recovered state estimates. Further, considering smarter attackers that are capable of designing stealthy attacks to p…
Sensors are embedded in security-critical applications from medical devices to nuclear power plants, but their outputs can be spoofed through electromagnetic and other types of signals transmitted by attackers at a distance. To address the lack of a unifying framework for evaluating the effects of such transmissions, we introduce a system and threat model for signal injection attacks. We further define the concepts of existential, selective, and universal security, which address attacker goals from mere disruptions of the sensor readings to precise waveform injections. Moreover, we introduce a…
We propose a new class of signal injection attacks on microphones by physically converting light to sound. We show how an attacker can inject arbitrary audio signals to a target microphone by aiming an amplitude-modulated light at the microphone's aperture. We then proceed to show how this effect leads to a remote voice-command injection attack on voice-controllable systems. Examining various products that use Amazon's Alexa, Apple's Siri, Facebook's Portal, and Google Assistant, we show how to use light to obtain control over these devices at distances up to 110 meters and from two separate b…
False Data Injection (FDI) attacks are a common form of Cyber-attack targetting smart grids. Detection of stealthy FDI attacks is impossible by the current bad data detection systems. Machine learning is one of the alternative methods proposed to detect FDI attacks. This paper analyzes three various supervised learning techniques, each to be used with three different feature selection (FS) techniques. These methods are tested on the IEEE 14-bus, 57-bus, and 118-bus systems for evaluation of versatility. Accuracy of the classification is used as the main evaluation method for each detection tec…
Hardware and software of secured embedded systems are prone to physical attacks. In particular, fault injection attacks revealed vulnerabilities on the data and the control flow allowing an attacker to break cryptographic or secured algorithms implementations. While many research studies concentrated on successful attacks on the data flow, only a few targets the instruction flow. In this paper, we focus on electromagnetic fault injection (EMFI) on the control flow, especially on the instruction cache. We target the very widespread (smartphones, tablets, settop-boxes, health-industry monitors a…
Texas A&M University（德克萨斯A&M大学）；Arkansas State University（阿肯色州立大学）
As a highly complex and integrated cyber-physical system, modern power grids are exposed to cyberattacks. False data injection attacks (FDIAs), specifically, represent a major class of cyber threats to smart grids by targeting the measurement data's integrity. Although various solutions have been proposed to detect those cyberattacks, the vast majority of the works have ignored the inherent graph structure of the power grid measurements and validated their detectors only for small test systems with less than a few hundred buses. To better exploit the spatial correlations of smart grid measurem…
A SCADA system is a distributed network of cyber-physical devices used for instrumentation and control of critical infrastructures such as an electric power grid. With the emergence of the smart grid, SCADA systems are increasingly required to be connected to more open systems and security becomes crucial. However, many of these SCADA systems have been deployed for decades and were initially not designed with security in mind. In particular, the field devices in these systems are vulnerable to false command injection from an intruding or compromised device. But implementing cryptographic defen…
Smart grids leverage the data collected from smart meters to make important operational decisions. However, they are vulnerable to False Data Injection (FDI) attacks in which an attacker manipulates meter data to disrupt the grid operations. Existing works on FDI are based on a simple threat model in which a single grid operator has access to all the data, and only some meters can be compromised. Our goal is to secure smart grids against FDI under a realistic threat model. To this end, we present a threat model in which there are multiple operators, each with a partial view of the grid, and ea…
Applications of cyber technologies improve the quality of monitoring and decision making in smart grid. These cyber technologies are vulnerable to malicious attacks, and compromising them can have serious technical and economical problems. This paper specifies the effect of compromising each measurement on the price of electricity, so that the attacker is able to change the prices in the desired direction (increasing or decreasing). Attacking and defending all measurements are impossible for the attacker and defender, respectively. This situation is modeled as a zero sum game between the attac…
The introduction of advanced communication infrastructure into the power grid raises a plethora of new opportunities to tackle climate change. This paper is concerned with the security of energy management systems which are expected to be implemented in the future smart grid. The existence of a novel class of false data injection attacks that are based on modifying forecasted demand data is demonstrated, and the impact of the attacks on a typical system's parameters is identified, using a simulated scenario. Monitoring strategies that the utility company may employ in order to detect the attac…
