False Data Injection Cyber-attacks Research Articles

Detection of Multiplicative False Data Injection Cyberattacks on Process Control Systems via Randomized Control Mode Switching

A fundamental problem at the intersection of process control and operations is the design of detection schemes monitoring a process for cyberattacks using operational data. Multiplicative false data injection (FDI) attacks modify operational data with a multiplicative factor and could be designed to be detection evading without in-depth process knowledge. In a prior work, we presented a control mode switching strategy that enhances the detection of multiplicative FDI attacks in processes operating at steady state (when process states evolve within a small neighborhood of the steady state). Control mode switching on the attack-free process at steady-state may induce transients and generate false alarms in the detection scheme. To minimize false alarms, we subsequently developed a control mode switch-scheduling condition for processes with an invertible output matrix. In the current work, we utilize a reachable set-based detection scheme and use randomized control mode switches to augment attack detection capabilities. The detection scheme eliminates potential false alarms occurring from control mode switching, even for processes with a non-invertible output matrix, while the randomized switching helps bolster the confidentiality of the switching schedule, preventing the design of a detection-evading “smart” attack. We present two simulation examples to illustrate attack detection without false alarms, and the merits of randomized switching (compared with scheduled switching) for the detection of a smart attack.

Urban Energy Transition Policy Implementation: Navigating Complex Political Realities and Overcoming Barriers to Effective Strategy Deployment

As the transition from traditional power grids to smart grids gains momentum, the integration of a cyber-layer into the system becomes imperative specially be considering policy and government intervention. However, this advancement also exposes the system to potential cyber threats, raising concerns about its security and resilience. This study focuses on bolstering cyber security resilience and detecting cyber-attacks (CAs) within urban microgrids. Specifically, the research investigates the impact of false data injection cyber-attacks, a significant threat to microgrids, on the steady-state performance of isolated microgrids. To combat such threats, a novel approach utilizing generative adversarial networks (GANs) is introduced to identify attacks on smart metering systems within microgrids. However, the GANs alone cannot make informed decisions, necessitating a decision-making framework. To address this requirement, a novel method based on prediction intervals is proposed to establish decision boundaries, determining the legitimacy of received data. To evaluate the proposed methodology's performance and accuracy, real-world data from a wind farm is employed. Results demonstrate the method's effectiveness and high accuracy in detecting false data injection attacks. Additionally, the study simulates a false data injection attack on a test microgrid to assess its resilience against CAs, revealing that a successful attack can significantly disrupt normal system operations. This research contributes to enhancing urban microgrid energy security by considering policy-informed decision-making, navigating complexity, and surmounting deployment barriers considering policy and government intervention.

Cyber-secure energy and flexibility scheduling of interconnected local energy networks with introducing an XGBoost-assisted false data detection and correction method

The growing penetration of renewable energy resources (RERs) and the ever-increasing implementation of information and communication technologies in smart grids necessitate the utilization of fast and safe operation methods. These schemes should be able to cope with the intermittency of uncertain RERs and fully explore the capabilities of new technologies while considering the vulnerabilities as a result of digitalization. Here, the integrity of the energy and flexibility scheduling and trading heavily depends on the security of the cyber-physical system. Local energy networks (LENs) are introduced to easily incorporate and utilize distributed energy resources, improving electrical power reliability and efficiency. This study develops a cyber-secure energy and flexibility scheduling platform for interconnected local energy networks. Hence, it introduces a novel false data detection and correction method based on the XGBoost machine learning method and investigates the performance of the proposed algorithm in the context of an interconnected local energy network and the corresponding energy and flexibility transactions. In this regard, this paper initially presents a bilevel energy and flexibility scheduling problem for interconnected local energy networks (ILENs) considering cyber-attacks (BLEFSCAILEN), which tries to satisfy the energy and flexibility requirements of the ILEN guaranteeing a resilient decision against false data injection cyber-attacks. Within the proposed BLEFSCAILEN a bi-level multi-objective optimization problem is defined where the operator of ILEN optimizes both energy and flexibility trading among LENs in the upper level to maximize its revenue. In the proposed structure, the operator of each LEN is situated at the lower level and tries to minimize the scheduling cost and simultaneously maximize the local flexibility index. Furthermore, in order to evaluate and improve the proposed system’s cyber-security, a false data injection attack is constructed using the Gaussian probability distribution function. Herein, the scheduling of ILEN is optimized considering vulnerabilities of electricity consumption data as a consequence of cyber-attack. Finally, the novel XGBoost-assisted deviation bound-based false data detection/correction (XGBFDD) algorithm is suggested to mitigate the above-mentioned cyber-attack and attain near real-world conditions. Simulation results demonstrate that the proposed false data detection/correction strategy exhibits a maximum accuracy of 91.67 precent in mitigating the attack effects. This is because the acquired post-correction results exhibit minor deviations in comparison to the original optimization output that is calculated with the pre-attack consumption data.

A reachable set-based scheme for the detection of false data injection cyberattacks on dynamic processes

Recent cyberattacks targeting process control systems have demonstrated that reliance on information technology-based approaches alone to address cybersecurity needs is insufficient and that operational technology-based solutions are needed. An attack detection scheme that monitors process operation and determines the presence of an attack represents an operational technology-based approach. Attack detection schemes may be designed to monitor a process operated at or near its steady–state to account for the typical operation of chemical processes. However, transient operation may occur; for example, during process start-up and set–point changes. Detection schemes designed or tuned for steady-state operation may raise false alarms during transient process operation. In this work, we present a reachable set-based cyberattack detection scheme for monitoring processes during transient operation. Both additive and multiplicative false data injection attacks (FDIAs) that alter data communicated over the sensor–controller and controller–actuator communication links are considered. For the class of attacks considered, the detection scheme does not raise false alarms during transient operations. Conditions for classifying attacks based on the ability of the detection scheme to detect the attacks are presented. The application of the reachable set-based detection scheme is demonstrated using two illustrative processes under different FDIAs. For the FDIAs considered, their detectability with respect to the reachable set-based detection scheme is analyzed.

Review of Cybersecurity Analysis in Smart Distribution Systems and Future Directions for Using Unsupervised Learning Methods for Cyber Detection

In a physical microgrid system, equipment failures, manual misbehavior of equipment, and power quality can be affected by intentional cyberattacks, made more dangerous by the widespread use of established communication networks via sensors. This paper comprehensively reviews smart grid challenges on cyber-physical and cyber security systems, standard protocols, communication, and sensor technology. Existing supervised learning-based Machine Learning (ML) methods for identifying cyberattacks in smart grids mostly rely on instances of both normal and attack events for training. Additionally, for supervised learning to be effective, the training dataset must contain representative examples of various attack situations having different patterns, which is challenging. Therefore, we reviewed a novel Data Mining (DM) approach based on unsupervised rules for identifying False Data Injection Cyber Attacks (FDIA) in smart grids using Phasor Measurement Unit (PMU) data. The unsupervised algorithm is excellent for discovering unidentified assault events since it only uses examples of typical events to train the detection models. The datasets used in our study, which looked at some well-known unsupervised detection methods, helped us assess the performances of different methods. The performance comparison with popular unsupervised algorithms is better at finding attack events if compared with supervised and Deep Learning (DL) algorithms.

Small-Signal Angle Stability-Oriented False Data Injection Cyber-Attacks on Power Systems

The small-signal angle stability (SSAS) of a power system is determined by the property of operation points. The widely applied false data injection (FDI) cyber-attack, however, is able to stealthily mislead the optimal power flow (OPF) and thus compromise operation points, leading to damages to the SSAS margin. To provide insights for cyber defenders, this paper proposes and investigates a stealthy SSAS-oriented FDI cyber-attack focusing on two attacking purposes, i.e., the SSAS margin and operation cost, with higher priority on the former one. First, this paper establishes a novel bi-level model with an implicit SSAS constraint based on a structure preserving model to compromise operation points. Then, for the SSAS interarea mode in a typical two-area system, this paper formulates closed-form expressions of how the SSAS margin and operation cost behave with respect to stealthy injections. By comparison, for the SSAS local mode in general power systems, this paper proposes a moving target cyber-attack-based hierarchical solution algorithm. Simulation results on a two-area system, a Kundur 11 bus system, and a modified IEEE 14 bus system demonstrate the significant damaging effects of the proposed SSAS-oriented FDI cyber-attack and the conflict between the two attacking purposes.

Identification of the False Data Injection Cyberattacks on the Internet of Things by using Deep Learning

Identification of the False Data Injection Cyberattacks on the Internet of Things by using Deep Learning

Detection of Random False Data Injection Cyberattacks in Smart Water Systems Using Optimized Deep Neural Networks

A cyberattack detection model based on supervised deep neural network is proposed to identify random false data injection (FDI) on the tank’s level measurements of a water distribution system. The architecture of the neural network, as well as various hyper-parameters, is modified and tuned to acquire the highest detection performance using the smallest size of training data set. The efficacy of the proposed detection model against various activation functions including sigmoid, rectified linear unit, and softmax is examined. Regularization and momentum techniques are applied to update the weights and prohibit overfitting. Moreover, statistical metrics are presented to evaluate the performance and effectiveness of the proposed model in the presence of a range of measurement noise levels. The proposed model is tested for three attack scenarios composed for the battle of the attack detection algorithms. Results confirm that the size of the data sets required to train the neural network (NN) to accomplish the highest levels of accuracy and precision is significantly decreased as the number of hidden layers is increased. The trained 4- and 5-layer deep neural networks are able to detect the readings’ FDIs with 100% precision and accuracy in the presence of 30% background noise in the sensory data.

A Remedial Action Scheme Against False Data Injection Cyberattacks in Smart Transmission Systems: Application of Thyristor-Controlled Series Capacitor (TCSC)

This article proposes a remedial action scheme (RAS) based on thyristor-controlled series capacitors (TCSCs) to cope with false data injection (FDI) cyberattacks leading to tie-line congestions in transmission systems. To develop such a RAS, a three-level framework is designed. The first level of the framework is associated with the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">planning</i> phase, where strategic locations of TCSCs are determined. The second level, which is related to the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">operation</i> phase, challenges the upgraded system via FDI attacks, resulting in tie-line congestions. This necessitates the third level of the framework, where system operator takes advantage of a RAS based on the preinstalled TCSCs to <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">rapidly</i> alleviate the congestions caused by FDIs. The effectiveness of the developed framework is verified on two IEEE test systems, where it is assumed that a higher budget is spent on securing remote terminal units of TCSCs; hence, phasor measurement units are more prone to cyberattacks.

Secure MPC/ANN-Based False Data Injection Cyber-Attack Detection and Mitigation in DC Microgrids

Direct current (DC) microgrids can be considered as cyber-physical systems due to implementation of measurement devices, communication network, and control layers. Consequently, dc microgrids are also vulnerable to cyber-attacks. False-data injection attacks (FDIAs) are a common type of cyber-attacks, which try to inject false data into the system in order to cause the defective behavior. This article proposes a method based on model predictive control (MPC) and artificial neural networks (ANNs) to detect and mitigate the FDIA in dc microgrids that are formed by parallel dc–dc converters. The proposed MPC/ANN-based strategy shows how MPC and ANNs can be coordinated to provide a secure control layer to detect and remove the FDIAs in the dc microgrid. In the proposed strategy, an ANN plays the role of the estimator to implement in the cyber-attack detection and mitigation strategy. The proposed method is examined under different conditions, physical events and cyber disturbances (i.e. load changing and communication delay, and time-varying attack), and the results of the MPC-based scheme is compared with conventional proportional-integral controllers. The obtained results show the effectiveness of the proposed strategy to detect and mitigate the attack in dc microgrids.

Load frequency control in the presence of simultaneous cyber-attack and participation of demand response program

Simultaneous investigation of demand response programs and false data injection cyber-attack are critical issues for the smart power system frequency regulation. To this purpose, in this paper, the output of the studied system is simultaneously divided into two subsystems: one part including false data injection cyder-attack and another part without cyder-attack. Then, false data injection cyber-attack and load disturbance are estimated by a non-linear sliding mode observer, simultaneously and separately. After that, demand response is incorporated in the uncertain power system to compensate the whole or a part of the load disturbance based on the available electrical power in the aggregators considering communication time delay. Finally, active disturbance rejection control is modified and introduced to remove the false data injection cyber-attack and control the uncompensated load disturbance. The salp swarm algorithm is used to design the parameters. The results of several simulation scenarios indicate the efficient performance of the proposed method.

The usage of power system multi-model forecasting aided state estimation for cyber attack detection

THE PURPOSE. Smart electrical grids involve extensive use of information infrastructure. Such an aggregate cyber-physical system can be subject to cyber attacks. One of the ways to counter cyberattacks is state estimation. State Estimation is used to identify the present power system operating state and eliminating metering errors and corrupted data. In particular, when a real measurement is replaced by a false one by a malefactor or a failure in the functioning of communication channels occurs, it is possible to detect false data and restore them. However, there is a class of cyberattacks, so-called False Data Injection Attack, aimed at distorting the results of the state estimation. The aim of the research was to develop a state estimation algorithm, which is able to work in the presence of cyber-attack with high accuracy.METHODS. The authors propose a Multi-Model Forecasting-Aided State Estimation method based on multi-model discrete tracking parameter estimation by the Kalman filter. The multimodal state estimator consisted of three single state estimators, which produced single estimates using different forecasting models. In this paper only linear forecasting models were considered, such as autoregression model, vector autoregression model and Holt’s exponen tial smoothing. When we obtained the multi-model estimate as the weighted sum of the single-model estimates. Cyberattack detection was implemented through innovative and residual analysis. The analysis of the proposed algorithm performance was carried out by simulation modeling using the example of a IEEE 30-bus system in Matlab.RESULTS. The paper describes an false data injection cyber attack and its specific impact on power system state estimation. A Multi - Model Forecasting-Aided State Estimation algorithm has been developed, which allows detecting cyber attacks and recovering corrupted data. Simulation of the algorithm has been carried out and its efficiency has been proved.CONCLUSION. The results showed the cyber attack detection rate of 100%. The Multi-Model Forecasting-Aided State Estimation is an protective measure against the impact of cyber attacks on power system.

Formulating false data injection cyberattacks on pumps’ flow rate resulting in cascading failures in smart water systems

As digital interconnections of smart cities greatly enhance the quality of life for residents, they also introduce challenges related to cybersecurity that may adversely impact critical infrastructure. Smart cities must secure their critical infrastructures against cyberattacks. Water distribution is one of these infrastructures. In this paper, a bi-level optimization model is developed for cyberattacks that can result in physical consequence of multiple node failures in water networks. Unlike the existing research that considered random cyberattacks, the proposed cyber–physical attack model injects targeted false data into pumps’ measurements causing pressure head buildup in targeted nodes. In addition, the injected false data will ensure bypassing the existing water system’s state-estimation and bad data detection methods, a condition that was not considered in previously developed attacks. The findings indicate the minimum number of targeted pumps required to create the most severe cascading failures across the water network. The model will identify strategic pumps that are likely to be targeted by cyberattacks, and therefore should be given extra layers of protection by water authorities. • A cybersecurity attack model in water distribution systems is proposed. • Minimum false data is injected on pump’s measurements to increase nodal heads. • Attack model bypasses state estimation causing cascading failures in water systems. • A nonlinear bi-level optimization problem is developed as the cyberattack model.

An optimized fuzzy sliding based active disturbance rejection control for simultaneous cyber‐attack tolerant and demand response participation program

The simultaneous investigation of false data injection cyber-attack (FDICA) and demand response (DR) participation in smart power systems are dealt with in this paper. For this purpose, simultaneous and separate detection of FDICA and determination of the changes in the power consumption for participation in DR (PDR) are necessary. To balance between generation and consumption, PDR must be equal to the load disturbances (LDs). Active-disturbance rejection control (ADRC) with the extended state observer (ESO) is implemented to detect FDICA and LDs. But, ESO only detects the sum of FDICA and LDs without the ability to separate them. Therefore, a nonlinear sliding mode observer (NSMO) is implemented to detach FDICA from LDs. In order to improve the NSMO estimation accuracy, the modified salp swarm algorithm (SSA) is implemented to design NSMO parameters. Moreover, to achieve better performance of ADRC, a fuzzy tuner is applied to the online tuning of controller parameters. The proposed optimized fuzzy sliding-based modified active-disturbance rejection control (FSADRC) is tested for load frequency control of the IEEE 9 bus standard test system and the 10 machines New England test power system considering communications time delay. The results of several simulation scenarios indicate the efficient performance of the proposed method.

A machine-learning approach for identification and mitigation of cyberattacks in networked process control systems

The robustness of process control systems to cyberattacks has become an increasingly important topic, especially in light of the increased dependence of process operations on networked control system architectures wherein dedicated sensor-controller and controller-actuator links are replaced by real-time, wired or wireless, shared communication networks. To mitigate the risks of cyberattacks, we propose in this work an integrated model-based framework for the detection, estimation and mitigation of false data injection cyberattacks in nonlinear networked process systems. The framework leverages a classification-based neural network scheme for attack detection and estimation, coupled with a stability-based attack mitigation strategy based on a model-based controller design. An illustrative chemical process example is used to demonstrate the effectiveness of the proposed framework and assess its robustness with respect to possible attack detection and estimation errors.

Protection of large-scale smart grids against false data injection cyberattacks leading to blackouts

Power system is one of the most critical cyber–physical systems in a sustainable society, whose security and reliability can significantly impact other infrastructures. Therefore, security and resilience of smart grids are one of the most challenging research questions in protection of critical infrastructures. After cyberattacks on the U.S. power grid in 2018, the national security agency announced cyberattacks might cause a blackout in transmission systems. Therefore, it is critical to model cyberattack scenarios, propose a detection strategy to mitigate these threats in a realistic context, and study how the models can improve the defense of large-scale grids. In this paper, a bi-level mixed-integer linear programming (BMILP) model is developed to accurately model false data injections (FDIs) that are targeted to overflow multiple transmission lines and cause a blackout in large-scale grids. Compared to the existing research, the proposed model considers that attackers might have limited access to measurement buses and models attacks on targeted transmission lines without being detected by existing DC state-estimation. In addition, to protect the system against these attacks, it is proved that a detection framework based on recursive weighted least-square (WLS) state-estimation can detect the FDIs, unlike classical weighted least square (WLS) estimation that fails to identify stealthy FDIs. To validate the effectiveness of the proposed attack model and detection framework in practical grid infrastructures, the IEEE 118-bus benchmark and a 2000-bus synthetic grid replicating the electricity network of Texas, U.S. are used.

Sequential false data injection cyberattacks in water distribution systems targeting storage tanks; a bi-level optimization model

While digital interconnectivity of smart cities has significantly enhanced the quality of life of residents, it has introduced cybersecurity challenges that may interrupt the operation of critical infrastructures. Water distribution systems are among the most critical infrastructures in smart cities that need to be secured against potential cyberattacks. False data injection cyberattacks in water distribution systems can be designed to bypass bad data detection algorithms, generating false measurements that ultimately lead to cascading failures. Developing models for these cyberattacks and analyzing them will elucidate hidden layers and tactics used to design the attacks, helping water systems’ authorities to improve and upgrade state-estimation processes and detection algorithms accordingly. In this paper, a bi-level nonlinear optimization cyberattack model is proposed that will result in sequential tank’s overflow or fully withdrawn in less than three hours. The attack model is developed based upon injecting false data into the hourly measurements of the pump(s) feeding the tank, as well as the total demand of the network. By modifying a few estimation parameters in the neighborhood of the targeted tank, these false data injections are deliberately designed to bypass the existing water system’s state-estimation and bad data detection methods.

A Cyber-Security Methodology for a Cyber-Physical Industrial Control System Testbed

Due to recent increase in deployment of Cyber-Physical Industrial Control Systems in different critical infrastructures, addressing cyber-security challenges of these systems is vital for assuring their reliability and secure operation in presence of malicious cyber attacks. Towards this end, developing a testbed to generate real-time data-sets for critical infrastructure that would be utilized for validation of real-time attack detection algorithms are indeed highly needed. This paper investigates and proposes the design and implementation of a cyber-physical industrial control system testbed where the Tennessee Eastman process is simulated in real-time on a PC and the closed-loop controllers are implemented on the Siemens PLCs. False data injection cyber attacks are injected to the developed testbed through the man-in-the-middle structure where the malicious hackers can in real-time modify the sensor measurements that are sent to the PLCs. Furthermore, various cyber attack detection algorithms are developed and implemented in real-time on the testbed and their performance and capabilities are compared and evaluated.

Integration of Failure Detector in Bias Filter for Estimation of False Data Injection Cyberattacks

In order to enable many of the required smart grid functionalities, distribution systems are becoming increasingly dependent on state estimators. Many cyber-attacks attempt false data injection (FDI) attacks on such state estimators. The majority of the existing literature deal with FDIs in distribution systems state estimation either by the analysis of the residual vector elements, or by the analysis of historical data. In this work, we adopt an alternative approach for the detection of FDIs in distribution system state estimation, wherein FDIs are modelled as measurement biases and a bias filter is employed for FDI detection. Additionally, in order to enable the detection of time-variable FDIs, a failure detector is integrated in the recursive formulation of the bias filter, which is based on the Kalman filter. The developed approach is accordingly capable of identifying time-varying FDIs, which can evade many of the existing FDI detection methods. Simulation case studies are performed on the IEEE 13-node and 123-node feeders with different FDIs and the performance of the proposed approach is analyzed.

Cooperative control for cyber–physical multi-agent networked control systems with unknown false data-injection and replay cyber-attacks

The paper discusses the cooperative tracking problem of partially known cyber–physical multi-agent networked systems. In this system, there exist two cascaded chances for cyber-attacks. The local agent is of networked system type that is subjected to unknown false data-injection and replay cyber-attacks that are dissimilar in the sensor-controller and the controller-actuator network parts. The communication between any two agents, if they are connected, is accomplished via a communication network that is subjected to false data-injection cyber-attacks. The problem of the existing two cascaded chances for cyber-attacks is solved in three steps. First, with partially known system parameters and unknown false data-injection and replay cyber-attacks, the state estimates of all the local followers are evaluated by designing local adaptive observers. Second, a new technique is designed to compensate for the unmatched terms that result from the use of local adaptive observers. After that, distributed adaptive leader–follower security controllers are proposed based on the local estimated information in addition to the infected arrived information from the neighbors. Meanwhile, it is verified that the suggested security control method guarantees that all states of the followers under the considered cyber-attacks follow the given leader asymptotically. The efficacy of the developed adaptive leader–follower security controllers is verified via an illustrative example.