This work establishes a game-theoretic framework to study cross-layer coordinated attacks on cyber-physical systems (CPSs). The attacker can interfere with the physical process and launch jamming attacks on the communication channels simultaneously. At the same time, the defender can dodge the jamming by dispensing with observations. The generic framework captures a wide variety of classic attack models on CPSs. Leveraging dynamic programming techniques, we fully characterize the Subgame Perfect Equilibrium (SPE) control strategies. We also derive the SPE observation and jamming strategies and provide efficient computational methods to compute them. The results demonstrate that the physical and cyber attacks are coordinated and depend on each other.
On the one hand, the control strategies are linear in the state estimate, and the estimate error caused by jamming attacks will induce performance degradation. On the other hand, the interactions between the attacker and the defender in the physical layer significantly impact the observation and jamming strategies. Numerical examples illustrate the interactions between the defender and the attacker through their observation and jamming strategies.
Providing situational awareness in light of severe coordinated cyber-attacks on power grids, where many measurements may be untrusted, is necessary for reliable monitoring and resilient operation of the grid. In this scenario, the set of good measurements is by itself insufficient for state estimation due to loss of observability. In this paper, we present a resilient state estimation algorithm, based on output clustering. By augmenting the measurement set by respective cluster variables, the system observability is regained, and a reliable state estimate can be computed. We show the numerical…
Existing coordinated cyber-attack detection methods have low detection accuracy and efficiency and poor generalization ability due to difficulties dealing with unbalanced attack data samples, high data dimensionality, and noisy data sets. This paper proposes a model for cyber and physical data fusion using a data link for detecting attacks on a Cyber-Physical Power System (CPPS). Two-step principal component analysis (PCA) is used for classifying the system's operating status. An adaptive synthetic sampling algorithm is used to reduce the imbalance in the categories' samples. The loss function…
As one of the most sophisticated attacks against power grids, coordinated cyber-physical attacks (CCPAs) damage the power grid's physical infrastructure and use a simultaneous cyber attack to mask its effect. This work proposes a novel approach to detect such attacks and identify the location of the line outages (due to the physical attack). The proposed approach consists of three parts. Firstly, moving target defense (MTD) is applied to expose the physical attack by actively perturbing transmission line reactance via distributed flexible AC transmission system (D-FACTS) devices. MTD invalidat…
In the analysis of coordinated network attacks on electric power cyber-physical system (CPS), it is difficult to restore the complete attack path, and the intent of the attack cannot be identified automatically. A method is therefore proposed for the extracting patterns of coordinated network attacks on electric power CPS based on temporal-topological correlation. First, the attack events are aggregated according to the alarm log of the cyber space, and a temporal-causal Bayesian network-based cyber attack recognition algorithm is proposed to parse out the cyber attack sequences of the same at…
This work proposes a moving target defense (MTD) strategy to detect coordinated cyber-physical attacks (CCPAs) against power grids. A CCPA consists of a physical attack, such as disconnecting a transmission line, followed by a coordinated cyber attack that injects false data into the sensor measurements to mask the effects of the physical attack. Such attacks can lead to undetectable line outages and cause significant damage to the grid. The main idea of the proposed approach is to invalidate the knowledge that the attackers use to mask the effects of the physical attack by actively perturbing…
Electric power grids are at risk of being compromised by high-impact cyber-security threats such as coordinated, timed attacks. Navigating this new threat landscape requires a deep understanding of the potential risks and complex attack processes in energy information systems, which in turn demands an unmanageable manual effort to timely process a large amount of cross-domain information. To provide an adequate basis to contextually assess and understand the situation of smart grids in case of coordinated cyber-attacks, we need a systematic and coherent approach to identify cyber incidents. In…
The Internet of Things (IoT) provides a salient communication environment to facilitate the coordinated charging of electric vehicle (EV) load. However, as IoT is connected with the public network, the coordinated charging system is in a low-level cyber security and greatly vulnerable to malicious attacks. This paper investigates the malicious mode attack (MMA), which is a new cyberattack pattern that simultaneously attacks massive EV charging piles to generate continuous sinusoidal power disturbance with the same frequency as the poorly-damped wide-area electromechanical mode. Thereby, high a…
Cyber-Physical Systems (CPS) are present in many settings addressing a myriad of purposes. Examples are Internet-of-Things (IoT) or sensing software embedded in appliances or even specialised meters that measure and respond to electricity demands in smart grids. Due to their pervasive nature, they are usually chosen as recipients for larger scope cyber-security attacks. Those promote system-wide disruptions and are directed towards one key aspect such as confidentiality, integrity, availability or a combination of those characteristics. Our paper focuses on a particular and distressing attack …
The problem of detecting replay attack to the linear stochastic system with Kalman filer state estimator and LQG controller is addressed. To this end, a dynamic attack detector method is proposed which is coupled with the dynamics of the system. While preserving stability of the main system, conditions on parameters of the attack detector dynamics are obtained such that the attack can be revealed by destabilization of a residual trajectory which is the difference between the estimated and measured output of the system. Using this method, system operator can adjust the detection rate based on t…
This paper proposes a post-disaster cyber-physical interdependent restoration scheduling (CPIRS) framework for active distribution networks (ADN) where the simultaneous damages on cyber and physical networks are considered. The ad hoc wireless device-to-device (D2D) communication is leveraged, for the first time, to establish cyber networks instantly after the disaster to support ADN restoration. The repair and operation crew dispatching, the remote-controlled network reconfiguration and the system operation with DERs can be effectively coordinated under the cyber-physical interactions. The un…
State estimators are crucial components of anomaly detectors that are used to monitor cyber-physical systems. Many frequently-used state estimators are susceptible to model risk as they rely critically on the availability of an accurate state-space model. Modeling errors make it more difficult to distinguish whether deviations from expected behavior are due to anomalies or simply a lack of knowledge about the system dynamics. In this research, we account for model uncertainty through a multiplicative noise framework. Specifically, we propose to use the multiplicative noise LQG based compensato…
The ability of grid-connected microgrids (MG) to operate in islanded mode makes them an efficient solution for improving power quality and reliability. This property of MG is very much beneficial for remote and undeveloped areas in progressing countries. Moreover, ICT technology has led to the development of Smart Standalone Microgrids (SSMG), which are inundated with a plethora of sensors. This allows multiple microgrids to be controlled in a coordinated way to achieve self-sufficiency in power. In such systems, there is much interdependency between various power, control and communication pa…
This paper presents a hybrid data-driven physics model-based framework for real time monitoring in smart grids. As the power grid transitions to the use of smart grid technology, it's real time monitoring becomes more vulnerable to cyber attacks like false data injections (FDI). Although smart grids cyber-physical security has an extensive scope, this paper focuses on FDI attacks, which are modeled as bad data. State of the art strategies for FDI detection in real time monitoring rely on physics model-based weighted least squares state estimation solution and statistical tests. This strategy i…
A resilient multi-vehicle system cooperatively performs tasks by exchanging information, detecting, and removing cyber attacks that have the intent of hijacking or diminishing performance of the entire system. In this paper, we propose a framework to: i) detect and isolate misbehaving vehicles in the network, and ii) securely encrypt information among the network to alert and attract nearby vehicles toward points of interest in the environment without explicitly broadcasting safety-critical information. To accomplish these goals, we leverage a decentralized virtual spring-damper mesh physics m…
This work proposes a moving target defense (MTD) strategy to detect coordinated cyber-physical attacks (CCPAs) against power grids. The main idea of the proposed approach is to invalidate the knowledge that the attackers use to mask the effects of their physical attack by actively perturbing the grid's transmission line reactances via distributed flexible AC transmission system (D-FACTS) devices. The proposed MTD design consists of two parts. First, we identify the subset of links for D-FACTS device deployment that enables the defender to detect CCPAs against any link in the system. Then, in o…
Cyber-Physical Energy Systems Modeling, Test Specification, and Co-Simulation Based Testing
Delft University of Technology（代尔夫特理工大学）；Technical University of Denmark（丹麦技术大学）；OFFIS e.V.（OFFIS研究所）；AIT Austrian Institute of Technology（奥地利技术研究院）；University Grenoble Alpes（格勒诺布尔阿尔卑斯大学）；Ormazabal Corporate Technology（奥玛萨巴尔企业技术）；University of Strathclyde（斯特拉斯克莱德大学）；HAW Hamburg University of Applied Sciences（汉堡应用科学大学）；Fraunhofer Institute of Wind Energy and Energy System Technology（弗劳恩霍夫风能及能源系统技术研究所）；European Distributed Energy Resources Laboratories (DERlab) e.V.（欧洲分布式能源资源实验室）
ACCESS Linnaeus Centre and the Department of Automatic Control, School of Electrical Engineering, KTH Royal Institute of Technology（ACCESS林奈斯中心，电气工程学院自动控制系，瑞典皇家理工学院）；KTH Royal Institute of Technology（瑞典皇家理工学院）；Scania CV AB（斯堪尼亚商用车公司）
