Stealthy False Data Injection Attacks Research Articles

Stochastic Stealthy False Data Injection Attacks Against Cyber-Physical Systems

This article studies the impact of stochastic stealthy false data injection attacks on the security of cyber-physical systems. The Kullback–Leibler divergence is used as the metric of stealthiness to detect the system anomalies. The attacker is able to inject false data into measurement and actuation channels at the same time. The goal of an attacker is to destabilize the systems while maintaining the Kullback–Leibler divergence under a certain threshold. First, in order to keep the stealthiness of attacks, the relationship between the threshold of Kullback–Leibler divergence and the upper bounds on the norms of mathematical expectation and covariance of the compromised innovation is given. Then, the sufficient and necessary conditions for the insecurity of systems are derived when all the measurement channels are compromised by an attacker. Furthermore, some sufficient conditions for the security of systems are presented in the cases that part of or no measurement channels are compromised. Finally, simulations are provided to illustrate the effectiveness of the obtained results.

Attention-aware deep reinforcement learning for detecting false data injection attacks in smart grids

Cyber-attacks have long undermined the security and stable operation of the smart grid. The increasing share of intermittent energy aggravates the uncertainty of the grid environment and makes it easier for attacks to be stealthy. In recent research, attackers can construct highly stealthy false data injection attacks (FDIAs) with as little-known information as possible. Faced with a volatile grid environment and severe cyber threats, we propose a deep reinforcement learning FDIAs detection method. It focuses on state attention to address the problems of state feature extraction in existing reinforcement learning detection methods. The proposed approach adds an attention mechanism to the model-free deep reinforcement learning detection algorithm to extract state features. Selective attention helps us focus on the important parts instead of distracting from irrelevant details, making the states more representative and distinguishable, thus improving the reinforcement learning framework to detect attacks faster and more accurately. The proposed method has experimented on IEEE-14, and IEEE-118 bus systems provided by the Institute of Electrical and Electronics Engineers (IEEE) and demonstrates the method’s satisfaction in terms of detection accuracy and efficiency compared with similar methods.© 2017 Elsevier Inc. All rights reserved.

A Resilient Cyber-Physical Demand Forecasting System for Critical Infrastructures against Stealthy False Data Injection Attacks

The safe and efficient function of critical national infrastructure (CNI) relies on the accurate demand forecast. Cyber-physical system-based demand forecasting systems (CDFS), typically found in CNI (such as energy, water, and transport), are highly vulnerable to being compromised under false data injection attacks (FDIAs). The problem is that the majority of existing CDFS employ anomaly-based intrusion detection systems (AIDS) to combat FDIAs. Since the distribution of demand time series keeps changing naturally with time, AIDS treat a major change in the distribution as an attack, but this approach is not effective against colluding FDIAs. To overcome this problem, we propose a novel resilient CDFS called PRDFS (Proposed Resilient Demand Forecasting System). The primary novelty of PRDFS is that it uses signature-based intrusion detection systems (SIDS) that automatically generate attack signatures through the game-theoretic approach for the early detection of malicious nodes. We simulate the performance of PRDFS under colluding FDIA on High Performance Computing (HPC). The simulation results show that the demand forecasting resilience of PRDFS never goes below 80%, regardless of the percentage of malicious nodes. In contrast, the resilience of the benchmark system decreases sharply from about 99% to less than 30%, over the simulation period as the percentage of malicious nodes increases.

Experience-Driven Attack Design and Federated-Learning-Based Intrusion Detection in Industry 4.0

The advent of Industry 4.0 facilitates the Int- ernet-of-Things-based-transactive energy system (IoTES), which enables innovative services with numerous independent distributed systems. These systems generate heterogeneous data in bulk, which become susceptible to cyber-attacks, particularly the stealthy false data injection attacks (FDIAs). The existing centralized FDIA detection algorithms often breach data privacy and fail to perform effectively in highly dynamic and distributed environments, such as IoTES. To resolve the issue, initially, a recurrent deep deterministic policy gradient is utilized to invent an experience-driven FDIA in a complex IoTES. The attacker intends to intelligently exploit the data integrity of smart energy meters with insufficient knowledge of the system. Subsequently, to countermove the stealth and enable independent clients to train a centralized model while keeping each client’s data privacy intact, a deep-federated-learning-based decentralized FDIA detection method using an attentive aggregation is exploited in this article. The proposed approach is capable of parallel computing and can reliably identify the stealthy FDIA on all the nodes simultaneously. Simulation results validate that the proposed scheme outperforms the state-of-the-art methods under a distributed environment with a significantly higher detection accuracy and lower computational complexity while keeping the data privacy intact.

False Data Injection Attacks Against State Estimation Without Knowledge of Estimators

This article investigates the stealthy false data injection attack design problem for a class of cyber physical systems equipped with state estimators and attack detectors. The objective is to worsen the estimation performance without triggering any alarm. First, a necessary and sufficient condition for the existence of perfect attacks, which alter the state estimate without affecting residual signals, is provided. It is shown that the estimation error can be arbitrarily large under the well-designed perfect attacks. Second, if the perfect attacks do not exist, the existence of nonperfect attacks, which worsen the estimation performance with a degree influence on residual signals, is analyzed. It is shown that the desired nonperfect attack sequence can be designed by analyzing the maximum eigenvalue and the corresponding eigenvector of an auxiliary matrix. Compared with the existing methods, in this article, attacks are designed without knowledge of estimators and can be injected from any time point. Finally, a numerical simulation is provided to illustrate the effectiveness of the proposed methods.

Voltage Stability Constrained Moving Target Defense Against Net Load Redistribution Attacks

Moving target defense (MTD) using distributed flexible AC transmission system (D-FACTS) devices is a promising defense strategy to detect stealthy false data injection (FDI) attacks against the power system state estimation. However, all existing studies myopically perturb the reactance of D-FACTS lines without considering the system voltage stability. In this paper, we first illustrate voltage instability induced by MTDs in a three-bus system. To address this issue, we further propose a novel MTD framework that explicitly considers system voltage stability by using continuation power flow and voltage stability indices. We mathematically derive the sensitivity matrix of voltage stability index to line impedance, on which an optimization problem for maximizing voltage stability index is formulated. This framework is tested on the IEEE 14-bus and the IEEE 118-bus transmission systems, in which net load redistribution attacks are launched by sophisticated attackers. The simulation results show the effectiveness of the proposed framework in circumventing the voltage instability while maintaining the detection effectiveness of MTD. We conduct case studies with and without the proposed framework under different MTD planning and operational methods. The impacts of the proposed two methods on attack detection effectiveness and system economic metrics are also revealed.

Electric load forecasting under False Data Injection Attacks using deep learning

Precise electric load forecasting at different time horizons is an essential aspect for electricity producers and consumers who participate in energy markets in order to maximize their economic efficiency. Moreover, accurate prediction of the electric load contributes toward robust and resilient power grids due to the error minimization of generators scheduling schemes. The accuracy of the existing electric load forecasting methods relies on data quality due to noisy real-world environments, and data integrity due to malicious cyber-attacks. This paper proposes a cyber-secure deep learning framework that accurately predicts electric load in power grids for a time horizon spanning from an hour to a week. The proposed deep learning framework systematically integrates Autoencoder (AE), Convolutional Neural Network (CNN), and Long Short-Term Memory (LSTM) models (AE-CLSTM). The feasibility of the proposed solution is validated by using realistic grid data acquired from the distribution network of Tabriz, Iran. Compared to other load forecasting methods, the proposed method shows the highest accuracy in both a normal case with real-world noise and a stealthy False Data Injection Attack (FDIA). The proposed load forecasting method is practical and suitable for mitigating noise in real-world data and integrity attacks.

Exploring Targeted and Stealthy False Data Injection Attacks via Adversarial Machine Learning

State estimation methods used in cyber–physical systems (CPSs), such as smart grid, are vulnerable to false data injection attacks (FDIAs). Although substantial deep learning methods have been proposed to detect such attacks, deep neural networks (DNNs) are highly susceptible to adversarial attacks, which modify input of DNNs with unnoticeable but malicious perturbations. This article proposes a method to explore targeted and stealthy FDIAs via adversarial machine learning. We pose FDIAs as sparse optimization problems to achieve initial attack objectives and remain stealthy during attacks. We propose a parallel optimization algorithm to efficiently solve the problems and explore additional sparse-state attacks. The experimental results show that for IEEE 14-bus and 118-bus systems, the success rate of two-state sparse attacks with small-scale targets is as high as 80%. In addition, the attack success rate can continue to increase as the number of attack states increases. The proposed attacks demonstrate that attackers can implement attacks that can bypass both bad data detectors and neural network detectors while keeping the initial attack objectives unchanged, which is a critical and urgent security threat in CPS.

Real-Time Locational Detection of Stealthy False Data Injection Attack in Smart Grid: Using Multivariate-Based Multi-Label Classification Approach

Recently, false data injection attacks (FDIAs) have been identified as a significant category of cyber-attacks targeting smart grids’ state estimation and monitoring systems. These cyber-attacks aim to mislead control system operations by compromising the readings of various smart grid meters. The real-time and precise locational identification of FDIAs is crucial for smart grid security and reliability. This paper proposes a multivariate-based multi-label locational detection (MMLD) mechanism to detect the presence and locations of FDIAs in real-time measurements with precise locational detection accuracy. The proposed architecture is a parallel structure that concatenates Long Short-Term Memory (LSTM) with Temporal Convolutional Neural Network (TCN). The proposed architecture is trained using Keras with Tensorflow libraries, and its performance is verified using an IEEE standard bus system in the MATPOWER package. Extensive testing has shown that the proposed approach effectively improves the presence-detection accuracy for locating stealthy FDIAs in small and large systems under various attack conditions. In addition, this work provides a customized loss function for handling the class imbalance problem. Simulation results reveal that our MMLD technique has a modest advantage in some aspects. First, our mechanism outperforms benchmark models because the problem is formulated as a multivariate-based multi-label classification problem. Second, it needs fewer iterations for training and reaching the optimal model. More specifically, our approach is less complex and more scalable than benchmark algorithms.

Stealthy FDI Attacks Against Networked Control Systems Using Two Filters With an Arbitrary Gain

This brief investigates a stealthy false data injection (FDI) attack scheme against two communication channels to damage the performance of a networked control system. Compared with most existing works, a more practical and reasonable assumption that an attacker only needs to know the physical system knowledge is considered. By using two filters with an arbitrary gain that can be different from the filter gain of the system, a novel feedback channel attack scheme is proposed to ensure the attack process is stealthy, and the forward channel attack signal can be flexibly designed according to specific attack purposes. It is proved that the proposed attack scheme can render the closed-loop system unstable while bypassing a residual-based detector. Two cases of simulation results are provided to verify the theoretical analysis results.

Impact of stealthy false data injection attacks on power flow of power transmission lines—A mathematical verification

Stealthy False Data Injection (SFDI) attacks in power systems can lead to a large-scale cascading failure, if not detected and eliminated quickly. The impact of such attacks can be minimized by using advanced control and protection mechanisms. This paper aims to provide mathematical proof for validation of the impact of SFDI attacks on power flow changes of power transmission lines equipped with metering devices based on graph theory, regardless of the network topology. In particular, it is assumed that an adversary attack targets a set of power transmission lines that are highly vulnerable to SFDI attacks, and corrupts the measurements, thus, changing the power flow of the entire power transmission system, leading to wrong power dispatches. Subsequently, an index is defined to show the power flow changes in case of SFDI attacks considering full and partial knowledge of true values of the system information. In addition, the valid boundaries of possible values for the defined index are determined. The proposed theorem can show how a controller can take protective measures to enhance the safety and reliability of power systems.

Stealthy false data injection attacks with resource constraints against multi-sensor estimation systems

This paper mainly investigates how to maximally degrade estimation performance of a cyber–physical system under limited resource. A stealthy false data injection (FDI) attack scheme is proposed to only attack partial sensor channels of a multi-sensor estimation system. The attack stealthiness condition and the compromised estimation error covariance are respectively derived, and then the stealthy attack problem is formed as a constrained optimization problem. An explicit solution of the optimal attack strategy is given and proven. Furthermore, the relationship between the compromised estimation error covariance and the attacked sensor is analyzed, and then the sensor selection principle is derived to decide which sensor channel should be attacked. Finally, two numerical simulation examples are provided to confirm the theoretical analysis results.

Optimal Coding Schemes for Detecting False Data Injection Attacks in Power System State Estimation

As a side-effect-free method, meter coding can successfully detect stealthy false data injection (FDI) attacks without significantly affecting physical plants by encoding the sensor outputs with an invertible matrix. However, since the relationship between the detection of stealthy FDI attacks and the cost of meter coding was not clearly analyzed in existing works, the optimal design of coding schemes has not been well studied. This paper investigates the optimal design of coding schemes based on the analysis of detection conditions for stealthy FDI attacks in power system state estimation. Specifically, detection conditions for stealthy FDI attacks are derived in both general and special coding schemes, which reveal the requirements on the encoded measurements, the coding scheme and the meters in power systems. Utilizing the constraints determined by the detection conditions, the optimization of the special coding scheme is formulated and equivalently simplified, which decouples the design of coding matrix with the other decision variables. Finally, simulation results are carried out on the alternating current (AC) state estimation in the IEEE 14-bus and 57-bus test systems to validate theoretical results on the conditions and cost of detecting stealthy FDI attacks in meter coding.

PowerFDNet: Deep Learning-Based Stealthy False Data Injection Attack Detection for AC-Model Transmission Systems

Recent studies have demonstrated that smart grids are vulnerable to stealthy false data injection attacks (SFDIAs), as SFDIAs can bypass residual-based bad data detection mechanisms. The SFDIA detection has become one of the focuses of smart grid research. Methods based on deep learning technology have shown promising accuracy in the detection of SFDIAs. However, most existing methods rely on the temporal structure of a sequence of measurements but do not take account of the spatial structure between buses and transmission lines. To address this issue, we propose a spatiotemporal deep network, PowerFDNet, for the SFDIA detection in AC-model power grids. The PowerFDNet consists of two sub-architectures: spatial architecture (SA) and temporal architecture (TA). The SA is aimed at extracting representations of bus/line measurements and modeling the spatial structure based on their representations. The TA is aimed at modeling the temporal structure of a sequence of measurements. Therefore, the proposed PowerFDNet can effectively model the spatiotemporal structure of measurements. Case studies on the detection of SFDIAs on the benchmark smart grids show that the PowerFDNet achieved significant improvement compared with the state-of-the-art SFDIA detection methods. In addition, an IoT-oriented lightweight prototype of size 52 MB is implemented and tested for mobile devices, which demonstrates the potential applications on mobile devices. The trained model will be available at \textit{https://github.com/HubYZ/PowerFDNet}.

Deception Attack Detection of Isolated DC Microgrids Under Consensus- Based Distributed Voltage Control Architecture

A consensus-based distributed voltage control architecture of isolated DC microgrids (MGs) with deception attack awareness is investigated in this paper. Firstly, a fully distributed voltage control algorithm with only adjacent information sharing is proposed by expanding the consensus-based distributed algorithm in AC MGs. To further enhance the ability of deception attack detection in the associated cyber network, an analytical consistency-based anomaly detection mechanism is also developed by manipulating primal variables and dual variables associated with the proposed distributed voltage control algorithm. Strategies for detecting either individual or stealthy false-data injection attacks on both links and nodes of the associated communication network against the distributed consensus-based droop control of DC MGs are investigated. Numerical experiments of a DC MG on real-time simulators are performed to validate the efficacy of the proposed deception attack detection mechanism.

A Deviation-Based Detection Method Against False Data Injection Attacks in Smart Grid

State estimation plays a vital role to ensure safe and reliable operations in smart grid. Intelligent attackers can carefully design a destructive and stealthy false data injection attack (FDIA) sequence such that commonly used weighted least squares estimator combined with residual-based detection method is vulnerable to the FDIA. To effectively defend against an FDIA, in this paper, we propose a robust deviation-based detection method, in which an additional Kalman filter is introduced while retaining the original weighted least squares estimator, so that there are two state estimators. Moreover, an exponential weighting function is also applied to the introduced Kalman filter in our proposed method. When an FDIA occurs, the estimation results of weighted least squares estimator depend only on meter measurements at each time slot, but there is an adjustment process of estimated states for the Kalman filter based on historical states' transitions. Meanwhile, based on the exponential weighting function, estimated measurements in the Kalman filter can be adaptively suppressed for different attack strengths of FDIAs, and then the difference of the results of these two estimators increases. Subsequently, FDIAs can be effectively detected by checking the deviation of estimated measurements about the two estimators with a detection threshold. Experimental results validate the effectiveness of the proposed detection method against FDIAs. The impact of different attack strengths and noise on detection performance is also evaluated and analyzed.

Defending False Data Injection on State Estimation Over Fading Wireless Channels

In this paper, a cyber-physical system (CPS) is considered, whose state estimation is done by a central controller (CC) using the measurements received from a wireless powered sensor network (WPSN) over fading channels. An adversary injects false data in this system by compromising some of the idle sensor nodes (SNs) of the WPSN. Using the WPSN for transmitting supervision and control data, in the aforementioned setting, makes the CPS vulnerable to both error and false data injection (FDI). The existing techniques of launching stealthy FDI attack are not applicable to the aforementioned network due to the random nature of wireless channels, which is used for both transmitting control and false data. The objectives of the adversary and the CC to launch stealthy FDI attack and to detect the same, respectively, are found to be depending on the powers they use for transmitting data over wireless channels. The transmit powers of the CC, and the adversary that fulfill their respective objectives are derived by modeling their interaction as a Bayesian Stackelberg game. Based on their objectives, novel utility functions are defined for the CC and the adversary. Subsequently, the equilibrium of the proposed game is obtained by solving a non-convex bi-level quadratic-quadratic program. Finally, the analytical results are verified and compared with other state-of-art techniques by applying them in a realistic smart grid simulations.

Distributed Data-Driven Intrusion Detection for Sparse Stealthy FDI Attacks in Smart Grids

The stealthy false data injection (FDI) attacks in smart grids can bypass the bad data detection, and thus make an incorrect state estimate in the control center. In this brief, a distributed data-driven intrusion detection approach is proposed to reveal the existence of the sparse stealthy FDI attack in a multi-area interconnected power system. The proposed distributed intrusion detection approach avoids the over-fitting issue that is extensively seen when implementing machine learning algorithms for large-scale systems. Firstly, each area estimates the entire system state based on a distributed state estimation algorithm. Then, the state of each local area is used as trained neural network input to detect the stealthy FDI attacks. Simulation results on the IEEE 118-bus system verify that the proposed method not only reduces the risk of over-fitting, but also can locate the areas which have been attacked.

Detection of stealthy false data injection attacks against networked control systems via active data modification

This paper investigates the design and detection problems of stealthy false data injection (FDI) attacks against networked control systems from the different perspectives of an attacker and a defender, respectively. First, a Kalman filter-based output tracking control system is presented, where stealthy FDI attacks are designed for its feedback and forward channels so as to destroy the system performance while bypassing a traditional residual-based detector. Second, to successfully detect such two-channel stealthy attacks, an active data modification scheme is proposed, by which the measurement and control data are amended before transmitting them through communication networks. Theoretical analysis is then carried out for both ideal and practical cases to evaluate the effectiveness of the detection scheme. An interesting finding is that the attacks designed based on a false model obtained from those modified data can remain stealthy. Finally, simulation results are provided to validate the proposed attack design and detection schemes.

Detecting stealthy false data injection attacks in the smart grid using ensemble-based machine learning

Stealthy false data injection attacks target state estimation in energy management systems in smart power grids to adversely affect operations of the power transmission systems. This paper presents a data-driven machine learning based scheme to detect stealthy false data injection attacks on state estimation. The scheme employs ensemble learning, where multiple classifiers are used and decisions by individual classifiers are further classified. Two ensembles are used in this scheme, one uses supervised classifiers while the other uses unsupervised classifiers. The scheme is validated using simulated data on the standard IEEE 14-bus system. Experimental results show that the performance of both supervised individual and ensemble models are comparable. However, for unsupervised models, the ensembles performed better than the individual classifiers.