Systematic attack design is essential to understanding the vulnerabilities of cyber-physical systems (CPSs), to better design for resiliency. In particular, false data injection attacks (FDIAs) are well-known and have been shown to be capable of bypassing bad data detection (BDD) while causing targeted biases in resulting state estimates. However, their effectiveness against moving horizon estimators (MHE) is not well understood. In fact, this paper shows that conventional FDIAs are generally ineffective against MHE. One of the main reasons is that the moving window renders the static FDIA recursively infeasible. This paper proposes a new attack methodology, moving-horizon FDIA (MH-FDIA), by considering both the performance of historical attacks and the current system's status. Theoretical guarantees for successful attack generation and recursive feasibility are given. Numerical simulations on the IEEE-14 bus system further validate the theoretical claims and show that the proposed MH-FDIA outperforms state-of-the-art counterparts in both stealthiness and effectiveness. In addition, \textcolor{blue}{an experiment on} a path-tracking control system of an autonomous vehicle shows the feasibility of the MH-FDIA in real-world nonlinear systems.
In this paper, an attack problem is investigated for event-based remote state estimation in cyber-physical systems. Our objective is to degrade the effect of the event-based scheduler while bypassing a $χ^2$ false data detector. A two-channel scheduler-pointed false data injection attack strategy is proposed by modifying the numerical characteristics of innovation signals. The attack strategy is proved to be always existent, and an algorithm is provided to find it. Under the proposed attack strategy, the scheduler becomes almost invalid and the performance of the remote estimator is degraded. …
The urgent need for the decarbonization of power girds has accelerated the integration of renewable energy. Concurrently the increasing distributed energy resources (DER) and advanced metering infrastructures (AMI) have transformed the power grids into a more sophisticated cyber-physical system with numerous communication devices. While these transitions provide economic and environmental value, they also impose increased risk of cyber attacks and operational challenges. This paper investigates the vulnerability of the power grids with high renewable penetration against an intraday false data …
In this paper, we examine the factors that influence the success of false data injection (FDI) attacks in the context of both cyber and physical styles of reinforcement. Many works consider the FDI attack in the context of the ability to change a measurement in a static system only. However, successful attacks will require first intrusion into a system followed by construction of an attack vector that can bypass bad data detection (BDD). In this way, we develop a full service framework for FDI risk assessment. The framework considers both the costs of system intrusion via a weighted graph asse…
A novel false data injection attack (FDIA) model against DC state estimation is proposed, which requires no network parameters and exploits only limited phasor measurement unit (PMU) data. The proposed FDIA model can target specific states and launch large deviation attacks using estimated line parameters. Sufficient conditions for the proposed method are also presented. Different attack vectors are studied in the IEEE 39-bus system, showing that the proposed FDIA method can successfully bypass the bad data detection (BDD) with high success rates of up to 95.3%.
False Data Injection (FDI) attacks against powersystem state estimation are a growing concern for operators.Previously, most works on FDI attacks have been performedunder the assumption of the attacker having full knowledge ofthe underlying system without clear justification. In this paper, wedevelop a topology-learning-aided FDI attack that allows stealthycyber-attacks against AC power system state estimation withoutprior knowledge of system information. The attack combinestopology learning technique, based only on branch and bus powerflows, and attacker-side pseudo-residual assessment to per…
Modern electric power grid, known as the Smart Grid, has fast transformed the isolated and centrally controlled power system to a fast and massively connected cyber-physical system that benefits from the revolutions happening in the communications and the fast adoption of Internet of Things devices. While the synergy of a vast number of cyber-physical entities has allowed the Smart Grid to be much more effective and sustainable in meeting the growing global energy challenges, it has also brought with it a large number of vulnerabilities resulting in breaches of data integrity, confidentiality …
This paper firstly addresses the problem of risk assessment under false data injection attacks on uncertain control systems. We consider an adversary with complete system knowledge, injecting stealthy false data into an uncertain control system. We then use the Value-at-Risk to characterize the risk associated with the attack impact caused by the adversary. The worst-case attack impact is characterized by the recently proposed output-to-output gain. We observe that the risk assessment problem corresponds to an infinite non-convex robust optimization problem. To this end, we use dissipative sys…
The false data injection (FDI) attack is a crucial form of cyber-physical security problems facing cyber-physical power systems. However, there is no research revealing the problem of FDI attacks facing voltage source converter based high voltage direct current transmission (VSC-HVDC) systems. Firstly, the general form of the model of FDI attack strategies is proposed and the essence of the problem of FDI attack strategies is further analyzed. Moreover, the model of FDI attack strategies aiming at disrupting the operation security of converter stations in VSC-HVDC systems is proposed and its s…
Spot pricing is often suggested as a method of increasing demand-side flexibility in electrical power load. However, few works have considered the vulnerability of spot pricing to financial fraud via false data injection (FDI) style attacks. In this paper, we consider attacks which aim to alter the consumer load profile to exploit intraday price dips. We examine an anomaly detection protocol for cyber-attacks that seek to leverage spot prices for financial gain. In this way we outline a methodology for detecting attacks on industrial load smart meters. We first create a feature clustering mode…
With the large scale penetration of electric vehicles (EVs) and the advent of bidirectional chargers, EV aggregators will become a major player in the voltage regulation market. This paper proposes a novel false data injection attack (FDIA) against the voltage regulation capacity estimation of EV charging stations, the process that underpins voltage regulation in distribution system. The proposed FDIA takes into account the uncertainty in EV mobility and network conditions. The attack vector with the largest expected adverse impact is the solution of a stochastic optimization problem subject t…
This paper studies the vulnerability of large-scale power systems to false data injection (FDI) attacks through their physical consequences. Prior work has shown that an attacker-defender bi-level linear program (ADBLP) can be used to determine the worst-case consequences of FDI attacks aiming to maximize the physical power flow on a target line. Understanding the consequences of these attacks requires consideration of power system operations commonly used in practice, specifically real-time contingency analysis (RTCA) and security constrained economic dispatch (SCED). An ADBLP is formulated w…
The security of energy supply in a power grid critically depends on the ability to accurately estimate the state of the system. However, manipulated power flow measurements can potentially hide overloads and bypass the bad data detection scheme to interfere the validity of estimated states. In this paper, we use an autoencoder neural network to detect anomalous system states and investigate the impact of hyperparameters on the detection performance for false data injection attacks that target power flows. Experimental results on the IEEE 118 bus system indicate that the proposed mechanism has …
Designing resilient control strategies for mitigating stealthy attacks is a crucial task in emerging cyber-physical systems. In the design of anomaly detectors, it is common to assume Gaussian noise models to maintain tractability; however, this assumption can lead the actual false alarm rate to be significantly higher than expected. We propose a distributionally robust anomaly detector for noise distributions in moment-based ambiguity sets. We design a detection threshold that guarantees that the actual false alarm rate is upper bounded by the desired one by using generalized Chebyshev inequa…
State estimation is a data processing algorithm for converting redundant meter measurements and other information into an estimate of the state of a power system. Relying heavily on meter measurements, state estimation has proven to be vulnerable to cyber attacks. In this paper, a novel targeted false data injection attack (FDIA) model against AC state estimation is proposed. Leveraging on the intrinsic load dynamics in ambient conditions and important properties of the Ornstein-Uhlenbeck process, we, from the viewpoint of intruders, design an algorithm to extract power network parameters pure…
Recently, moving target defence (MTD) has been proposed to thwart false data injection (FDI) attacks in power system state estimation by proactively triggering the distributed flexible AC transmission system (D-FACTS) devices. One of the key challenges for MTD in power grid is to design its real-time implementation with performance guarantees against unknown attacks. Converting from the noiseless assumptions in the literature, this paper investigates the MTD design problem in a noisy environment and proposes, for the first time, the concept of robust MTD to guarantee the worst-case detection r…
This paper discusses how a cyber attack could take advantage of torsional resonances in the shaft of turbo-generators to inflict severe physical damage to a power system. If attackers were able to take over the control of a battery energy storage device, they could modulate the injection of this device at a frequency that matches one of the sub-synchronous resonance frequencies of a generator. Small changes in injection might be sufficient to excite one of these mechanical resonances, resulting in metal fatigue and ultimately a catastrophic failure in the shaft of the generator. Using a state-…
Small-Signal Stability (SSS) is crucial for the control of power grids. However, False Data Injection (FDI) attacks against SSS can impact the grid stability, hence, the security of SSS needs to be studied. This paper proposes a formal method of synthesizing FDI attack vectors (i.e., a set of measurements to be altered) that can destabilize power systems. We formulate an FDI attack as an optimization problem using AC power flow, SSS model, and stability constraints. The attacker capability is modeled as the accessibility to a limited set of measurements. The solution of the proposed FDI attack…
Fast and accurate detection of cyberattacks is a key element for a cyber-resilient power system. Recently, data-driven detectors and physics-based Moving Target Defences (MTD) have been proposed to detect false data injection (FDI) attacks on state estimation. However, the uncontrollable false positive rate of the data-driven detector and the extra cost of frequent MTD usage limit their wide applications. Few works have explored the overlap between these two areas. To fill this gap, this paper proposes blending data-driven and physics-based approaches to enhance the detection performance. To s…
In this paper, we consider a hierarchical control based DC microgrid (DCmG) equipped with unknown input observer (UIO) based detectors, where the potential false data injection (FDI) attacks and the distributed countermeasure are investigated. First, we find that the vulnerability of the UIO-based detector originates from the lacked knowledge of true unknown inputs. Zero trace stealthy (ZTS) attacks can be launched by secretly faking the unknown inputs, under which the detection residual will not be altered, and the impact on the DCmG in terms of voltage balancing and current sharing is theore…
We investigate a linear quadratic Gaussian (LQG) tracking problem with safety and reachability constraints in the presence of an adversary who mounts an FDI attack on an unknown set of sensors. For each possible set of compromised sensors, we maintain a state estimator disregarding the sensors in that set, and calculate the optimal LQG control input at each time based on this estimate. We propose a control policy which constrains the control input to lie within a fixed distance of the optimal control input corresponding to each state estimate. The control input is obtained at each time step by…
In this paper, quickest detection of false data injection attack on remote state estimation is considered. A set of $N$ sensors make noisy linear observations of a discrete-time linear process with Gaussian noise, and report the observations to a remote estimator. The challenge is the presence of a few potentially malicious sensors which can start strategically manipulating their observations at a random time in order to skew the estimates. The quickest attack detection problem for a known {\em linear} attack scheme in the Bayesian setting with a Geometric prior on the attack initiation instan…
State estimation is of considerable significance for the power system operation and control. However, well-designed false data injection attacks can utilize blind spots in conventional residual-based bad data detection methods to manipulate measurements in a coordinated manner and thus affect the secure operation and economic dispatch of grids. In this paper, we propose a detection approach based on an autoencoder neural network. By training the network on the dependencies intrinsic in 'normal' operation data, it effectively overcomes the challenge of unbalanced training data that is inherent …
This paper demonstrates that false data injection (FDI) attacks are extremely limited in their ability to cause physical consequences on $N-1$ reliable power systems operating with real-time contingency analysis (RTCA) and security constrained economic dispatch (SCED). Prior work has shown that FDI attacks can be designed via an attacker-defender bi-level linear program (ADBLP) to cause physical overflows after re-dispatch using DCOPF. In this paper, it is shown that attacks designed using DCOPF fail to cause overflows on $N-1$ reliable systems because the system response modeled is inaccurate…
Accurate and reliable dynamic state quantities of generators are very important for real-time monitoring and control of the power system. The emergence of cyber attacks has brought new challenges to the state estimation of generators. Especially, false data injection (FDI) attacks deteriorate the accuracy of state estimation by injecting the false data into the measurement device. In this regard, this paper proposes for the first time an FDI attack model based on the dynamic state estimation of generators. Firstly, Taylor's formula was used to linearize the generator's measurement equation. Se…
Cyber Physical Systems (cps) are deployed in many mission-critical settings, such as medical devices, autonomous vehicular systems and aircraft control management systems. As more and more CPS adopt Deep Neural Networks (Deep Neural Network (dnns), these systems can be vulnerable to attacks. . Prior work has demonstrated the susceptibility of CPS to False Data Injection Attacks (False Data Injection Attacks (fdias), which can cause significant damage. We identify a new category of attacks on these systems. In this paper, we demonstrate that DNN based CPS are also subject to these attacks. Thes…
