• Energy Research

In this article, the resilience of a coordinated control system for a set of PV-based distributed energy resources (DERs) against false data injection (FDI) attacks is evaluated. The evaluation is performed using a functional mock-up interface (FMI)-compatible cosimulation platform which enables the interaction of multi-domain simulators (EMTP, MATLAB/Simulink, and NS-3). The cosimulation platform permits rigorous analysis of cybersecurity through detailed modeling of all system components. The DER coordinated control and communication systems implemented on the IEEE-34 bus benchmark consist of measurement, control and monitoring components including substation central controller, DER local controllers, synchrophasor network and advanced metering infrastructure (AMI). Some DERs are equipped with an energy storage system (ESS) and coordinated by the central control unit in order to correct voltage disturbances resulting from the intermittent solar photovoltaic (PV) generation. The FDI attack targets the AMI system and aims at manipulating the load profile messages reported by the smart meter collector, thus yielding a central control failure. To detect the attacks and mitigate their impacts, a neural network-based algorithm is proposed and incorporated in the central control unit. The effectiveness of the proposed detection and mitigation algorithm is confirmed through simulations using the proposed FMI-compatible cosimulation platform.

In this paper, we formulate an attack on the relative data alignment scheme used by Phasor Data Concentrators (PDCs) to aggregate and stream phasor measurements. This attack leverages the specification governing the PDC functionality in a Wide Area Measurement System (WAMS). Using a Phasor Measurement Unit (PMU) as an attack surface, an adversary injects an attack vector in the PMU timing to manipulate the PDC functionality and force it to drop phasors received from benign PMUs. We expose the PDC relative data alignment scheme to this attack, formulate the attack surface and vector selection as a Linear Program (LP), and demonstrate the impact of this attack on system observability. Our experimental results on standard IEEE test systems demonstrate the attack semantics and impact. In addition, we present the attack in a case study using hardware-in-the-loop co-simulation environment. The outcome of these tests validate the vulnerability of the PDC aggregation scheme to this attack and its significance in targeting system observability.

State estimation is a data processing algorithm for converting redundant meter measurements and other information into an estimate of the state of a power system. Relying heavily on meter measurements, state estimation has proven to be vulnerable to cyber attacks. In this paper, a novel targeted false data injection attack (FDIA) model against AC state estimation is proposed. Leveraging on the intrinsic load dynamics in ambient conditions and important properties of the Ornstein-Uhlenbeck process, we, from the viewpoint of intruders, design an algorithm to extract power network parameters purely from PMU data, which are further used to construct the FDIA vector. Requiring no network parameters and relying only on limited phasor measurement unit (PMU) data, the proposed FDIA model can target specific states and launch large deviation attacks. Sufficient conditions for the proposed FDIA model are also developed. Various attack vectors and attacking regions are studied in the IEEE 39-bus system, showing that the proposed FDIA method can successfully bypass the bad data detection and launch targeted large deviation attacks with very high probabilities.

This paper investigates the possible cyber-physical attacks on voltage stability monitoring of a power transmission system. By considering a smart adversary that can launch a vector attack based on power flow equations, conventional voltage stability monitoring systems based on voltage stability indexes will fail to detect the instability issue. This can mislead the Power System Operator (PSO) to take inappropriate corrective action. In order to prevent and to combat such a malicious attack, a new indicator for efficient intrusion detection and a novel mitigation algorithm is proposed. This proposed detection algorithm employs the multi-port equivalent circuit of the power system to calculate the Thevenin Equivalent (TE) parameters. These TE parameters are then used to calculate an indicator, which reveals the attack on Phasor Measurement Unit (PMU) data. The proposed mitigation scheme then helps PSO to detect which PMU is under-attack. Furthermore, the amount of injected attack vectors is computed or estimated depending on the number of compromised PMUs. The effectiveness of the proposed techniques is demonstrated via illustrative case studies.

The digitalization of power systems over the past decade has made the cybersecurity of substations a top priority for regulatory agencies and utilities. Proprietary communication protocols are being increasingly replaced by standardized and interoperable protocols providing utility operators with remote access and control capabilities at the expense of growing cyberattack risks. In particular, the potential of supply chain cyberattacks is on the rise in industrial control systems. In this environment, there is a pressing need for the development of cyberattack detection systems for substations and in particular protective relays, a critical component of substation operation. This paper presents a deep learning-based cyberattack detection system for transmission line protective relays. The proposed cyberattack detection system is first trained with current and voltage measurements representing various types of faults on the transmission lines. The cyberattack detection system is then employed to detect current and voltage measurements that are maliciously injected by an attacker to trigger the transmission line protective relays. The proposed cyberattack detection system is evaluated under a variety of cyberattack scenarios. The results demonstrate that a universal architecture can be designed for the deep learning-based cyberattack detection systems in substations.

The rapid adoption of the smart grid’s nascent load-management capabilities, such as demand-side management and smart home systems, and the emergence of new classes of controllable high-wattage loads, such as energy storage systems and electric vehicles, magnify the smart grid’s exposure to load-altering cyberattacks. These attacks aim at disrupting power grid services by staging a synchronized activation/deactivation of numerous customers’ high-wattage appliances. A proper defense plan is needed to respond to such attacks and maintain the stability of the grid, and would include prevention, detection, mitigation, incident response, and/or recovery strategies. In this paper, we propose a solution to detect load-altering cyberattacks using a time-delay neural network that monitors the grid’s load profile. As a case study, we consider a cyberattack scenario against demand-side management programs that control the loads of residential electrical water heaters in order to perform peak shaving. The proposed solution can be adapted to other load-altering attacks involving different demand-side management programs or other classes of loads. Experiments verify the proposed solution’s efficacy in detecting load-altering attacks with high precision and low false alarm and latency.