Cyber Security Of Power Systems Research Articles

Power Network Vulnerability Assessment Based on Electric Power System Cyber Security Simulation Platform

Abstract This paper introduces a modeling approach for the integration of electric power and information networks, along with the creation of an electric power system network simulation platform. The system, achieved through the deep integration of computation, communication, and control technologies, offers new insights into power grid intelligence. The paper discusses the concept of power system vulnerability and presents a modeling scheme that effectively simulates and analyzes power systems. Using the Analytic Hierarchy Process (AHP), the impact of cyber attacks under different load conditions is evaluated, revealing that attacks have more severe consequences under heavy loads. In conclusion, this research contributes to enhancing the security and stability of power systems.

An Online Approach to Covert Attack Detection and Identification in Power Systems

The development of information technology and digital control systems has posed an inevitable trend of interconnectivity and wirelessness of data communications in power systems. As a result, the cybersecurity of power systems has been raising concerns over the past decades. Yet the complexity of power systems and their conventional designs with local and wide area network communications has posed increasing vulnerability to cyberattacks. Among the types of cyberattacks, data integrity attacks can be more harmful to power systems, especially power transmission systems, through malicious manipulation of measurement and control data to cause damage to the physical system. As the sophistication of cyberattacks increases, certain cyberattacks can successfully bypass traditional intrusion detection systems, which calls for better design of detection schemes. On the other hand, in a large-scale network, attack identification for a power system is as important as attack detection. In this paper, we develop an online approach based on the Sparse Group Lasso to detect and identify the location of a typical type of data integrity attack named <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">covert attacks</i> on power transmission systems. We provide the theoretical foundation of the proposed method with a simplified linear system model and extend the method to nonlinear systems. We validate the performance of our method on both linear and nonlinear system settings with a comprehensive numerical study.

A Robust Strategy for Leveraging Soft Open Points to Mitigate Load Altering Attacks

Power system cybersecurity is emerging as a critical and urgent problem to the energy sector due to the ongoing power grid modernization initiative. Load altering attack (LAA) is an important category of cyberattacks on the modern power systems, in which the attackers may damage the grid by viciously altering the remotely controllable loads (RCL) that are not properly protected. In order to mitigate the impacts of LAAs on the distribution systems, the promising soft open point (SOP) technology is deployed in this study. A two-stage optimization framework is proposed for the optimal installation and operation of SOPs for defending the distribution systems against LAAs. A chance-constrained optimization model is developed to guarantee the confidence level of the proposed two-stage model of SOPs in mitigating the impacts of LAAs. Further, a Wasserstein metric based distributionally robust chance-constrained (DRCC) optimization method is developed to ensure the robustness of the proposed model against the ambiguity of the empirical probability distribution in practice. Case studies were performed on a 69-bus test system to validate the proposed method. The results of case studies show that the proposed framework is able to mitigate the impacts of LAAs on distribution systems with the installation of SOPs. By applying the DRCC optimization method, the proposed model manages to keep satisfactory confidence levels under the ambiguous probability distributions in the case studies.

An Extreme Value Theory-Based Catastrophe Bond Design for Cyber Risk Management of Power Systems

Cybersecurity is emerging as one of the most critical issues for the power system operation in recent years. The most recent studies have shown that cyber-insurance can be an effective solution for the cyber risk management of power grids. In these early attempts, actuarial frameworks and premium schemes were designed for the insurance companies to cope with the risks on power system cybersecurity. However, due to the potentially catastrophic consequences of malicious cyberattacks on power grids, the tail risk events may expose the insurance companies to undue financial risks even if applicable premiums have been designed and collected, which will demotivate the insurance companies from entering the market and providing insurance to the power system stakeholders. In this paper, a Catastrophe (CAT) bond scheme is proposed for insurance companies to address the tail risk of power system cybersecurity by seeking protection from the capital market. The CAT bonds are designed based on the extreme value theory (EVT) to quantify the underlying risk of tail cybersecurity events in power systems. A stochastic model is developed and used in this paper to evaluate the potential losses of power system stakeholders due to malicious cyberattacks on the grids. An example on the IEEE Reliability Test System (RTS-96) was conducted and analyzed to demonstrate the validity and performance of the proposed EVT based CAT bond scheme. The results of the example show that the proposed CAT bond design can effectively manage the insolvency risk of insurers when providing cyber insurance to various stakeholders in power systems.

Authenticating source information of distribution synchrophasors at intra-state locations for cyber-physical resilient power networks

As power systems are gradually evolving into more efficient and intelligent cyber-physical energy systems with the large-scale penetration of renewable energies and information and communication technologies, they become increasingly reliant upon more accurate monitoring and fast control. Phasor Measurement Units (PMUs) collect high-precision Distribution Synchrophasors (DS) data regarding the system dynamics and provide real-time situational awareness for better monitoring and control of large-scale power grids. The accuracy and generalizability of the PMUs heavily rely upon the data quality of DS measurements, which is very susceptible to newly emerging “Source ID Mix” data spoofing attacks. Such attacks could maliciously alter a large portion of supposedly protected data, which may not be easily detected by existing operational practices, thereby jeopardizing most DS-based applications and even causing catastrophic power interruptions. This paper proposes a novel data-driven source authentication method to automatically identify the source information of DS collected from multiple intra-state locations and thus enhance the reliability and cybersecurity of power systems. The proposed method integrates Mathematical Morphological Decomposition (MMD) and Multi-Weighted Deep Stacking Forest (MLW-DSF) for providing accurate source authentication with a low computational cost which requires neither system’s models nor parameters. The effectiveness of the proposed method is corroborated through seven “state-of-the-art” data-driven models by using real-life DS measurements of power networks in Queensland state.© 2017 Elsevier Inc. All rights reserved.

Review of Blockchain Potential Applications in the Electricity Sector and Challenges for Large Scale Adoption

Blockchain technology applications in the electricity sector are getting considerable attention from both academia and industry. It is expected that blockchain will play an important role in the transition to the smart grid. The blockchain applications in the electricity sector can be classified to optimizing existing processes like metering and billing or grid management and using blockchain for emerging applications such as creating new platforms for value exchange like peer-to-peer (P2P) energy trading. This paper briefly introduces the fundamentals of blockchain technology, such as different types of blockchain networks and consensus mechanisms, in addition to introducing a few blockchain platforms that are widely used in current studies, projects, and startups or may have future potential in the electricity sector applications. The contribution of this paper is to provide a review of potential applications of blockchain in many electricity sector use cases, and they are categorized into eight categories such as P2P energy trading, wholesale markets, retail markets, metering and billing, trading of renewable energy certificates (RECs) and carbon credits, electric mobility, enhancement of power system cyber security, investments in renewable energy sources (RESs), and power system operation and management. Moreover, examples of research studies, pilot projects, industrial projects, startups, or companies investigating the blockchain capabilities at each potential application are introduced. Furthermore, the studies presented in each use case are compared to clarify and highlight the blockchain functions and involved actors. Finally, the paper discusses the challenges that blockchain technology is facing that obstruct large-scale adoption in different sectors and in the electricity sector specifically and potential solutions to these challenges that are being developed.

Cyber security as an important factor of ensuring the life of the domestic energy industry

The issue of cybersecurity of the domestic energy industry has been studied. The strategic principles of increasing the level of cyber resilience of communication and technological systems of energy industry enterprises are considered. The positive experience of the United States and the United Kingdom on the organizational and legal framework for preventing and minimizing encroachment on critical energy infrastructure is highlighted. The methodology of cyber threat analysis and risk assessment of cybersecurity violations of energy infrastructure facilities is detailed. The issue of cybersecurity of energy facilities and automated systems is generalized. The initiatives and directions of activity of the National Security and Defense Council of Ukraine for the purpose of development of cybersecurity of power systems are opened. The directions of the improvement to the formation of conceptual foundations for cybersecurity in the energy sector of Ukraine are identified.

PSO Supported Ensemble Algorithm for Bad Data Detection Against Intelligent Hacking Algorithm

Power system cybersecurity has recently become important due to cyber-attacks. Due to advanced computer science and machine learning (ML) applications being used by malicious attackers, cybersecurity is becoming crucial to creating sustainable, reliable, efficient, and well-protected cyber-systems. Power system operators are needed to develop sophisticated detection mechanisms. In this study, a novel machine-learning-based detection algorithm that combines the five most popular ML algorithms with Particle Swarm Optimizer (PSO) is developed and tested by using an intelligent hacking algorithm that is specially developed to measure the effectiveness of this study. The hacking algorithm provides three different types of injections: random, continuous random, and slow injections by adaptive manner. This would make detection harder. Results shows that recall values with the proposed algorithm for each different type of attack have been increased.

Profit-Oriented False Data Injection on Electricity Market: Reviews, Analyses, and Insights

The rapid evolution of sensor technologies and communication networks is tightly coupling the cyber and physical layers of power systems. Because a few power grids have fallen victim to cyber intrusions causing unexpected device failure and large-scale power outages, enhancing power system cybersecurity is the utmost focus of power grid development today. Financially, the deregulation of the electricity market opens the gate to profit-oriented cyberattacks. Real-time market auctions rely heavily on the accuracy of state estimation, which is susceptible to cyberattacks. Extensive reviews have been conducted on modern power system cybersecurity. However, the lack of a comprehensive and in-depth review of electricity market cyberattacks prevents independent system operators from systematically analyzing the financial consequences of cyberattacks and limits public awareness of the significant monetary loss. This article briefly summarizes previous review works and analyzes the two-settlement market design from a cybersecurity perspective. Then the current achievements of electricity market cyberattacks are discussed, and state-of-the-art works are analyzed based on their contributions. Additionally, a few possible improvements and future directions are presented.

Model-Free Data Authentication for Cyber Security in Power Systems

With the development and wide deployment of measurement equipment, data can be automatically measured and visualized for situation awareness in power systems. However, the cyber security of power systems is also threated by data spoofing attacks. This letter proposed a measurement data source authentication (MDSA) algorithm based on feature extraction techniques including ensemble empirical mode decomposition (EEMD) and fast Fourier transform (FFT), and machine learning for real-time measurement data classification. Compared with previous work, the proposed algorithm can achieve higher accuracy of MDSA using a shorter window of data from closely located synchrophasor measurement sensors.

Hijacking internet‐connected devices to provoke harmful oscillations in an electrical network: a feasibility assessment

Internet-connected devices will represent an increasing proportion of the load served by electric power systems. As these devices could conceivably be hijacked and controlled remotely by a malicious actor, they could represent a new threat vector against the dynamic security of a power system. Such attack strategies have not been considered in the existing literature on power system cybersecurity. As an initial scoping exercise, the present case study explores whether such devices could be remotely hijacked and then maliciously power-cycled at particular frequencies to deliberately provoke harmful oscillations in an electrical grid. To gauge the broad feasibility of this novel style of attack, dynamic simulations are performed on two representative test power systems, at differing levels of attacker and defender resources. These simulations show that power-cycling just 1% of consumer loads at a system's resonant frequency may sometimes provoke harmful electromechanical oscillations throughout a national grid. This novel simulation exercise, therefore, implies that cybersecurity vulnerabilities at the consumer side could jeopardise the physical integrity of a nation's entire electricity supply.

A Hybrid Cyber Attack Model for Cyber-Physical Power Systems

Over the past decade, the cyber security of power systems has been widely studied. Most previous studies have focused on cyber physical attacks, and barely considered one typical cyber attack: availability attack. We propose a hybrid attack model and apply conventional state estimation processes to study cyber attacks on power grids in this paper. The proposed model considers both integrity attack and availability attack simultaneously. Compared with the particular attack, namely, false data injected attack, we analyze their consequences to power systems in the events of false negatives attack and false alarm attack. The results show that the hybrid attack can confuse the control center by manipulating the integrity and availability of measurements. More importantly, we evaluate the hybrid attack with different values of the cost ratio between integrity and availability attacks, and then verify that the hybrid attack can achieve the same goal with a reduced cost.

From Static to Dynamic Anomaly Detection With Application to Power System Cyber Security

Developing advanced diagnosis tools to detect cyber attacks is the key to security of power systems. It has been shown that multivariate data injection attacks can bypass bad data detection schemes typically built on static behavior of the systems, which misleads operators to disruptive decisions. In this article, we depart from the existing static viewpoint to develop a diagnosis filter that captures the dynamics signatures of such a multivariate intrusion. To this end, we introduce a dynamic residual generator approach formulated as robust optimization programs in order to detect a class of disruptive multivariate attacks that potentially remain stealthy in view of a static bad data detector. We investigate two possible desired features: (i) a non-zero transient and (ii) a non-zero steady-state behavior of the residual generator in the presence of an attack. In case (i), the problem is reformulated as a finite, but possibly non-convex, optimization program. We further develop a linear programming relaxation that improves the scalability, and as such practicality, of the diagnosis filter design. In case (ii), it turns out that the resulting robust program admits an exact convex reformulation, yielding a Nash equilibrium between the attacker and the residual generator. This assertion has an interesting implication: the proposed approach is not conservative in the sense that the additional knowledge of the worst-case attack does not improve the diagnosis performance. To illustrate our theoretical results, we implement the proposed diagnosis filter to detect multivariate attacks on the system measurements deployed to generate the so-called Automatic Generation Control signals in a three-area IEEE 39-bus system.

Dynamic Data Injection Attack Detection of Cyber Physical Power Systems With Uncertainties

Understanding potential behaviors of attackers is of paramount importance for improving the cybersecurity of power systems. However, the attack behaviors in existing studies are often modeled statically on a single snapshot, which neglects the reality of a dynamically time-evolving power system. Accordingly, a dynamic cyber-attack model with local network information is proposed to characterize the typical data injection attack with the integration of potential dynamic behaviors of an attacker. The proposed model collaboratively alters the meter measurement in a stealthy way to illegally contaminate the system state, thus posing severe threats to cyber physical power systems. We then develop a novel anomaly detection countermeasure from the perspective of state estimation to effectively recognize the dynamic injection attack. In this countermeasure, an interval state forecasting method is proposed to approximate the possible largest variation bounds of each state variable based on a worst-case analysis considering the forecasting uncertainties of renewable energy sources, electric loads, and network parameter perturbations. In addition, the kernel quantile regression is introduced and implemented to formulate the uncertainties in renewable energy and electric load forecast as a series of confidence intervals. When any state variable falls outside its preforecasted intervals, the proposed countermeasure detects the anomaly and sets an alarm condition indicating the possibility of data contamination. Finally, the results from our extensive studies on several IEEE standard test systems have been presented to demonstrate the feasibility of the dynamic attack and the effectiveness of the detection countermeasure.

Power system effects and mitigation recommendations for DER cyberattacks

Extensive deployment of interoperable distributed energy resources (DER) is increasing the power system cyber security attack surface. National and jurisdictional interconnection standards require DER to include a range of autonomous and commanded grid-support functions, which can drastically influence power quality, voltage, and bulk system frequency. Here, the authors investigate the impact to the cyber-physical power system in scenarios where communications and operations of DER are controlled by an adversary. The findings show that each grid-support function exposes the power system to distinct types and magnitudes of risk. The physical impact from cyber actions was analysed in cases of DER providing distribution system voltage regulation and transmission system support. Finally, recommendations are presented for minimising the risk using engineered parameter limits and segmenting the control network to minimise common-mode vulnerabilities.

Assessment of Power System Risk in Cyber-Attacks in View of the Role Protection Systems

&lt;p&gt;This paper presents a risk assessment method for assessing the cyber security of power systems in view of the role of protection systems. This paper examines the collision of transmission and bus line protection systems positioned in substations on the cyber-physical performance of the power systems. The projected method simulates the physical feedback of power systems to hateful attacks on protection system settings and parameters. The relationship between protection device settings, protection logic, and circuit breaker logic is analyzed. The expected load reduction (ELC) indicator is used in this paper to determine potential losses in the system due to cyber attacks. The Monte Carlo simulation is used to calculate ELC’s account to assess the capabilities of the attackers and bus arrangements are changed. The influence of the projected risk assessment method is illustrated by the use of the 9-bus system and the IEEE-68 bus system.&lt;/p&gt;

Power System Risk Assessment in Cyber Attacks Considering the Role of Protection Systems

This paper presents a risk assessment method for evaluating the cyber security of power systems considering the role of protection systems. This paper considers the impact of bus and transmission line protection systems located in substations on the cyber-physical performance of power systems. The proposed method simulates the physical response of power systems to malicious attacks on protection system settings and parameters. The relationship among settings of protection devices, protection logics, and circuit breaker logics is analyzed. The expected load curtailment (ELC) index is used in this paper to quantify potential system losses due to cyber attacks. The Monte Carlo simulation is applied to calculate ELC for assessing attackers’ capabilities as bus arrangements are altered. The effectiveness of the proposed risk assessment method is demonstrated using a 9-bus system and the IEEE 68-bus system.

Power system DNP3 data object security using data sets

Power system cyber security demand is escalating with the increased number of security incidents and the increased stakeholder participation in power system operations, specifically consumers. Rule-based cyber security is proposed for Distributed Network Protocol (DNP3) outstation devices, with a focus on smart distribution system devices. The security utilizes the DNP3 application layer function codes and data objects to determine data access authorization for outstations, augmenting other security solutions that include firewalls, encryption, and authentication. The cyber security proposed in this article protects outstation devices when masters are compromised or attempt unauthorized access that bypass the other security solutions. In this article, non-utility stakeholder data access is limited through DNP3 data sets rather than granting direct access to the data points within an outstation. The data set utilization greatly constrains possible attack methods against a device by reducing the interaction capabilities with an outstation. The data sets also decrease the security complexity through rule reduction, thereby increasing the security applicability for retrofitted or process constrained devices. Temporal security constraints are supported for the data sets, increasing security against denial of service attacks.