In recent years, cyber-security of power systems has become a growing concern. To protect power systems from malicious adversaries, advanced defense strategies that exploit sophisticated detection algorithms are required. Motivated by this, in this paper we introduce an active defense method based on dynamic clustering. Our detection strategy uses a moving-target approach where information about the system's varying operating point is first used to cluster measurements according to their transfer function characteristics that change over time. Then, detection is carried out through series of similarity checks between measurements within the same cluster. The proposed method is effective in detecting cyber-attacks even when the attacker has extensive knowledge of the system parameters, model and detection policy at some point in time. The effectiveness of our proposed detection algorithm is demonstrated through a numerical example on the IEEE 24-bus power system.
As one of the most sophisticated attacks against power grids, coordinated cyber-physical attacks (CCPAs) damage the power grid's physical infrastructure and use a simultaneous cyber attack to mask its effect. This work proposes a novel approach to detect such attacks and identify the location of the line outages (due to the physical attack). The proposed approach consists of three parts. Firstly, moving target defense (MTD) is applied to expose the physical attack by actively perturbing transmission line reactance via distributed flexible AC transmission system (D-FACTS) devices. MTD invalidat…
This paper outlines a cyber-physical authentication strategy to protect power system infrastructure against false data injection (FDI) attacks. We demonstrate that it is feasible to use small, low-cost, yet highly attack-resistant security chips as measurement nodes, enhanced with an event-triggered moving target defence (MTD), to offer effective cyber-physical security. At the cyber layer, the proposed solution is based on the MULTOS Trust-Anchor chip, using an authenticated encryption protocol, offering cryptographically protected and chained reports at up to 12/s. The availability of the tr…
In this paper, we examine the factors that influence the success of false data injection (FDI) attacks in the context of both cyber and physical styles of reinforcement. Many works consider the FDI attack in the context of the ability to change a measurement in a static system only. However, successful attacks will require first intrusion into a system followed by construction of an attack vector that can bypass bad data detection (BDD). In this way, we develop a full service framework for FDI risk assessment. The framework considers both the costs of system intrusion via a weighted graph asse…
This work proposes a moving target defense (MTD) strategy to detect coordinated cyber-physical attacks (CCPAs) against power grids. A CCPA consists of a physical attack, such as disconnecting a transmission line, followed by a coordinated cyber attack that injects false data into the sensor measurements to mask the effects of the physical attack. Such attacks can lead to undetectable line outages and cause significant damage to the grid. The main idea of the proposed approach is to invalidate the knowledge that the attackers use to mask the effects of the physical attack by actively perturbing…
This work proposes a moving target defense (MTD) strategy to detect coordinated cyber-physical attacks (CCPAs) against power grids. The main idea of the proposed approach is to invalidate the knowledge that the attackers use to mask the effects of their physical attack by actively perturbing the grid's transmission line reactances via distributed flexible AC transmission system (D-FACTS) devices. The proposed MTD design consists of two parts. First, we identify the subset of links for D-FACTS device deployment that enables the defender to detect CCPAs against any link in the system. Then, in o…
Providing situational awareness in light of severe coordinated cyber-attacks on power grids, where many measurements may be untrusted, is necessary for reliable monitoring and resilient operation of the grid. In this scenario, the set of good measurements is by itself insufficient for state estimation due to loss of observability. In this paper, we present a resilient state estimation algorithm, based on output clustering. By augmenting the measurement set by respective cluster variables, the system observability is regained, and a reliable state estimate can be computed. We show the numerical…
Fast and accurate detection of cyberattacks is a key element for a cyber-resilient power system. Recently, data-driven detectors and physics-based Moving Target Defences (MTD) have been proposed to detect false data injection (FDI) attacks on state estimation. However, the uncontrollable false positive rate of the data-driven detector and the extra cost of frequent MTD usage limit their wide applications. Few works have explored the overlap between these two areas. To fill this gap, this paper proposes blending data-driven and physics-based approaches to enhance the detection performance. To s…
With developing of computation tools in the last years, data analysis methods to find insightful information are becoming more common among industries and researchers. This paper is the first part of the times series analysis of New England electricity price and demand to find anomaly in the data. In this paper time-series stationary criteria to prepare data for further times-series related analysis is investigated. Three main analysis are conducted in this paper, including moving average, moving standard deviation and augmented Dickey-Fuller test. The data used in this paper is New England bi…
Industry is moving towards advanced Cyber-Physical Systems (CPS), with trends in smartness, automation, connectivity and collaboration. We examine the drivers and requirements for the use of edge computing in critical industrial applications. Our purpose is to provide a better understanding of industrial needs and to initiate a discussion on what role edge computing could take, complementing current industrial and embedded systems, and the cloud. Four domains are chosen for analysis with representative use-cases; manufacturing, transportation, the energy sector and networked applications in th…
This draft addresses issues of detecting stealthy integrity cyber-attacks on automatic control systems in the unified control and detection framework. A general form of integrity cyber-attacks that cannot be detected using the well-established observer-based technique is first introduced as kernel attacks. The well-known replay, zero dynamics and covert attacks are special forms of the kernel attacks. Existence conditions for the kernel attacks are presented. It is demonstrated, in the unified framework of control and detection, that all kernel attacks can be structurally detected when not onl…
Digitization and remote connectivity have enlarged the attack surface and made cyber systems more vulnerable. As attackers become increasingly sophisticated and resourceful, mere reliance on traditional cyber protection, such as intrusion detection, firewalls, and encryption, is insufficient to secure the cyber systems. Cyber resilience provides a new security paradigm that complements inadequate protection with resilience mechanisms. A Cyber-Resilient Mechanism (CRM) adapts to the known or zero-day threats and uncertainties in real-time and strategically responds to them to maintain critical …
Smart grids integrate communication systems with power networks to enable power grids operation and command through real-time data collection and control signals. Designing, analyzing, and simulating smart grid infrastructures as well as predicting the impact of power network failures strongly depend on the topologies of the underlying power network and communication system. Despite the substantial impact that the communication systems bring to smart grid operation, the topology of communication systems employed in smart grids was less studied. The power community lacks realistic generative co…
BT-MTD: Bus Traversal-based Moving Target Defense for Smart Grid
College of Computer Engineering and Science, Shanghai University（上海大学计算机工程与科学学院）；School of Future Technology, Shanghai University（上海大学未来技术学院）；Purple Mountain Laboratories（紫金山实验室）
