Stealthy False Data Injection Attacks Research Articles

Optimal D-FACTS Placement in Moving Target Defense Against False Data Injection Attacks

Moving target defense (MTD) is a defense strategy to detect stealthy false data injection (FDI) attacks against the power system state estimation using distributed flexible AC transmission system (D-FACTS) devices. However, existing studies neglect to address a fundamental yet critical issue, i.e., the D-FACTS placement, by assuming that all lines are equipped with D-FACTS devices. To tackle this problem, we first derive analytical necessary conditions and requirements on the D-FACTS placement for a complete MTD. Further, we propose sufficient conditions using a graph theory-based topology analysis to ensure that the MTD under the proposed D-FACTS placement has the maximum rank of its composite matrix, which is indicative of the MTD effectiveness. Based on the analytical conditions, we design D-FACTS placement algorithms by using the minimum number of D-FACTS devices to achieve the maximum MTD effectiveness. A novel MTD-based ACOPF model, in which the reactance of D-FACTS lines is introduced as decision variables, is proposed to find a trade-off between the system loss and the MTD effectiveness. Numerical results on 6-bus, IEEE 14-bus, and IEEE 118-bus systems show the efficacy of MTDs using the proposed D-FACTS placement algorithms in maximizing the composite matrix rank and detecting FDI attacks.

Memoryless Cumulative Sign Detector for Stealthy CPS Sensor Attacks

Stealthy false data injection attacks on cyber-physical systems introduce erroneous measurements onto sensors with the intent to degrade system performance. An intelligent attacker can design stealthy attacks with knowledge of the system model and noise characteristics to evade detection from state-of-the-art fault detectors by remaining within detection thresholds. However, during these hidden attacks, an attacker with the intention of hijacking a system will leave traces of non-random behavior that contradict with the expectation of the system model. Given these premises, in this paper we propose a run-time monitor called Cumulative Sign (CUSIGN) detector, for identifying stealthy falsified measurements by identifying if measurements are no longer behaving in a random manner. Specifically, our proposed CUSIGN monitor considers the changes in sign of the measurement residuals and their expected occurrence in order to detect if a sensor could be compromised. Moreover, our detector is designed to be a memoryless procedure, eliminating the need to store large sequences of data for attack detection. We characterize the detection capabilities of the proposed CUSIGN technique following the well-known X2 failure detection scheme. Additionally, we show the advantage of augmenting CUSIGN to the model-based Cumulative Sum (CUSUM) detector, which provides magnitude bounds on attacks, for enhanced detection of sensor spoofing attacks. Our approach is validated with simulations on an unmanned ground vehicle (UGV) during a navigation case study.

Joint Admittance Perturbation and Meter Protection for Mitigating Stealthy FDI Attacks Against Power System State Estimation

Power system state estimation is subject to false data injection (FDI) attacks, because of the integration of advanced computation and communication techniques in power systems. By coordinately tampering the readings of meters, FDI attacks can bypass bad data detectors and stealthily mislead the results of state estimation. In this paper, we propose a joint admittance perturbation and meter protection (JAPMP) strategy to enhance the resilience of state estimation under stealthy FDI attacks, i.e., recover system states from compromised measurements. State recovery conditions in JAPMP are derived, which indicate that the integration of admittance perturbation and meter protection can significantly improve the recoverability of system states. Based on the state recovery conditions, a JAPMP optimization problem is formulated and solved by decomposing the joint optimization problem into two subproblems. Then, a heuristic algorithm is designed, which can greatly reduce the computational complexity in solving the combinatorial problem. Based on the simulation results on a 6-bus, the IEEE 14-bus, the IEEE 57-bus and the IEEE 118-bus test systems, the protection cost and performance of state recovery under stealthy FDI attacks are evaluated.

Analysis of Moving Target Defense Against False Data Injection Attacks on Power Grid

Recent studies have considered thwarting false data injection (FDI) attacks against state estimation in power grids by proactively perturbing branch susceptances. This approach is known as moving target defense (MTD). However, despite of the deployment of MTD, it is still possible for the attacker to launch stealthy FDI attacks generated with former branch susceptances. In this paper, we prove that, an MTD has the capability to thwart all FDI attacks constructed with former branch susceptances only if (i) the number of branches $l$ in the power system is not less than twice that of the system states $n$ (i.e., $l \geq 2n$, where $n + 1$ is the number of buses); (ii) the susceptances of more than $n$ branches, which cover all buses, are perturbed. Moreover, we prove that the state variable of a bus that is only connected by a single branch (no matter it is perturbed or not) can always be modified by the attacker. Nevertheless, in order to reduce the attack opportunities of potential attackers, we first exploit the impact of the susceptance perturbation magnitude on the dimension of the \emph{stealthy attack space}, in which the attack vector is constructed with former branch susceptances. Then, we propose that, by perturbing an appropriate set of branches, we can minimize the dimension of the \emph{stealthy attack space} and maximize the number of covered buses. Besides, we consider the increasing operation cost caused by the activation of MTD. Finally, we conduct extensive simulations to illustrate our findings with IEEE standard test power systems.

Enhanced Hidden Moving Target Defense in Smart Grids

Recent research has proposed a moving target defense (MTD) approach that actively changes transmission line susceptance to preclude stealthy false data injection (FDI) attacks against the state estimation of a smart grid. However, existing studies were often conducted under a weak adversarial setting, in that they ignore the possibility that alert attackers can also try to detect the activation of MTD before they launch the FDI attacks. We call this new threat as parameter confirming-first (PCF) FDI. To improve the stealthiness of MTD, we propose a hidden MTD approach that cannot be detected by the attackers and prove its equivalence to an MTD that maintains the power flows of the whole grid. Moreover, we analyze the completeness of MTD and show that any hidden MTD is incomplete in that FDI attacks may bypass the hidden MTD opportunistically. This result suggests that the stealthiness and completeness are two conflicting goals in MTD design. Finally, we propose an approach to enhancing the hidden MTD against a class of highly structured FDI attacks. We also discuss the MTD’s operational costs under the dc and ac models. We conduct simulations to show the effectiveness of the hidden MTD against PCF-FDI attacks under realistic settings.

Optimal stealthy false data injection attacks in cyber-physical systems

In this paper, the problem of false data injection attacks for cyber-physical systems is investigated. The Kullback–Leibler divergence is utilized to measure the stealthiness of the attacks. Different from the existing attack policies which are required to be zero-mean Gaussian distributed, a more general linear attack strategy based on Gaussian distribution with an arbitrary mean is proposed. Under the framework of the attacks, the degradation of system performance is analyzed by utilizing the statistical characteristics of the measurement innovation, and the optimal attack strategy is obtained by employing the Lagrange multiplier method to solve a constrained quadratic optimization problem. It is proved that the developed attack scheme can achieve the largest remote estimation error and guarantee the attack stealthiness simultaneously. Finally, simulation examples are provided to demonstrate the theoretical results.

A Fast, Decentralized Covariance Selection-Based Approach to Detect Cyber Attacks in Smart Grids

Recent studies have shown that an attacker can compromise some of the power grid measurements to mislead the conventional state estimators (SEs), since the manipulated measurements can pass the SE residue tests. Statistical structure learning-based approaches have been recently introduced as a powerful tool to detect some of the most complicated cyber attacks. However, the expensive computational complexity of the learning process limits the applicability of these approaches for real time cyber attack detection. This paper proposes a fast and decentralized approach for cyber attack detection based on a maximum likelihood (ML) estimation which exploits the near chordal sparsity of power grids to establish an efficient framework to solve the associated ML estimation problem. The proposed detection method is then decomposed to several local ML estimation problems; this would ensure privacy and reduce the complexity of the underlying problem. The simulation studies validate the efficiency of the proposed method in detecting truly complicated stealthy false data injection attacks.

Resilient Control for Networked Control Systems Subject to Cyber/Physical Attacks

In this paper, we investigate a resilient control strategy for networked control systems (NCSs) subject to zero dynamic attacks which are stealthy false-data injection attacks that are designed so that they cannot be detected based on control input and measurement data. Cyber resilience represents the ability of systems or network architectures to continue providing their intended behavior during attack and recovery. When a cyber attack on the control signal of a networked control system is computed to remain undetectable from passive model-based fault detection and isolation schemes, we show that the consequence of a zero dynamic attack on the state variable of the plant is undetectable during attack but it becomes apparent after the end of the attack. A resilient linear quadratic Gaussian controller, having the ability to quickly recover the nominal behavior of the closed-loop system after the attack end, is designed by updating online the Kalman filter from information given by an active version of the generalized likelihood ratio detector.

Stealthy false data injection attacks using matrix recovery and independent component analysis in smart grid

Exact state estimation is vital important to maintain common operations of smart grids. Existing researches demonstrate that state estimation output could be compromised by malicious attacks. However, to construct the attack vectors, a usual presumption in most works is that the attacker has perfect information regarding the topology and so on even such information is difficult to acquire in practice. Recent research shows that Independent Component Analysis (ICA) can be used for inferring topology information which can be used to originate undetectable attacks and even to alter the price of electricity for the profits of attackers. However, we found that the above ICA-based blind attack tactics is merely feasible in the environment with Gaussian noises. If there are outliers (device malfunction and communication errors), the Bad Data Detector will easily detect the attack. Hence, we propose a robust ICA based blind attack strategy that one can use matrix recovery to circumvent the outlier problem and construct stealthy attack vectors. The proposed attack strategies are tested with IEEE representative 14-bus system. Simulations verify the feasibility of the proposed method.

Coding Schemes for Securing Cyber-Physical Systems Against Stealthy Data Injection Attacks

This paper considers a method of coding the sensor outputs in order to detect stealthy false data injection attacks. An intelligent attacker can design a sequence of data injection to sensors and actuators that pass the state estimator and statistical fault detector, based on knowledge of the system parameters. To stay undetected, the injected data should increase the state estimation errors while keep the estimation residues small. We employ a coding matrix to change the original sensor outputs to increase the estimation residues under intelligent data injection attacks. This is a low-cost method compared with encryption schemes over all sensor measurements in communication networks. We show the conditions of a feasible coding matrix under the assumption that the attacker does not have knowledge of the exact coding matrix. An algorithm is developed to compute a feasible coding matrix, and, we show that in general, multiple feasible coding matrices exist. To defend against attackers who estimates the coding matrix via sensor and actuator measurements, time-varying coding matrices are designed according to the detection requirements. A heuristic algorithm to decide the time length of updating a coding matrix is then proposed.

Modeling and performance evaluation of stealthy false data injection attacks on smart grid in the presence of corrupted measurements

The false data injection (FDI) attack cannot be detected by the traditional anomaly detection techniques used in the energy system state estimators. In this paper, we demonstrate how FDI attacks can be constructed blindly, i.e., without system knowledge; including topological connectivity and line reactance information. Our analysis reveals that existing FDI attacks become detectable (consequently unsuccessful) by the state estimator if the data contains grossly corrupted measurements such as device malfunction and communication errors. The proposed sparse optimization based stealthy attacks construction strategy overcomes this limitation by separating the gross errors from the measurement matrix. Extensive theoretical modeling and experimental evaluation show that the proposed technique performs more stealthily (has less relative error) and efficiently (fast enough to maintain time requirement) compared to other methods on IEEE benchmark test systems.

Two-Channel False Data Injection Attacks Against Output Tracking Control of Networked Systems

This paper addresses the design problem of false data injection (FDI) attacks against the output tracking control of networked systems, where the network-induced delays in the feedback and forward channels are considered. The main contributions of this paper are as follows. 1) To actively compensate for the two-channel network-induced delays, a Kalman filter-based networked predictive control scheme is designed for stochastic linear discrete-time systems. 2) From an attacker’s perspective, stealthy FDI attacks are proposed for both the feedback and forward channels so as to disrupt the stability of the resulting closed-loop system while avoiding the detection of a Kalman filter-based attack detector. 3) Both numerical simulations and practical experiments are carried out to show the effectiveness of the proposed method.

Online Detection of Stealthy False Data Injection Attacks in Power System State Estimation

State estimation is one of the fundamental functions in modern power grid operations that provide operators with situational awareness and is used by several applications like contingency analysis and power markets. Several research in the recent past have highlighted the vulnerability of state estimators to stealthy false data injection attacks that bypass bad data detection mechanisms. They primarily focused on identifying stealthy attack vectors and characterizing their impacts on state estimates. Existing mitigation measures either focus on masking the effect of attacks through redundant measurements or prevent attacks by increasing the cyber security of associated sensors and communication channels. The solutions based on these offline approaches make specific assumptions about the nature of attacks and of the system, which are often restrictive and grossly inadequate to deal with dynamically evolving cyber threats and changing system configurations. In this paper, we propose an online anomaly detection algorithm that utilizes load forecasts, generation schedules, and synchrophasor data to detect measurement anomalies. We provide some insight into the factors that affect the performance of the proposed algorithm. We also describe an empirical method to obtain the minimum attack magnitudes and the detection thresholds for meeting specified false positive and true positive rates. Finally, we evaluated the performance of the proposed algorithm using the IEEE 14 bus power system model for several measures (false positive, false negative, and thresholds). We observed that the best performance of the proposed algorithm relies on finding the right balance between the minimum attack magnitude and detection thresholds. We also observed that the minimum attack magnitudes and detection thresholds could be further improved through the use of a combination of more accurate forecasts and PMU measurements.