Early detection of cyber-attacks is crucial for a safe and reliable operation of the smart grid. In the literature, outlier detection schemes making sample-by-sample decisions and online detection schemes requiring perfect attack models have been proposed. In this paper, we formulate the online attack anomaly detection problem as a partially observable Markov decision process (POMDP) problem and propose a universal robust online detection algorithm using the framework of model-free reinforcement learning (RL) for POMDPs. Numerical studies illustrate the effectiveness of the proposed RL-based algorithm in timely and accurate detection of cyber-attacks targeting the smart grid.
In this work, we consider the smart grid security problem from the defender's perspective and seek for an effective detection scheme using RL techniques (single-agent RL) . Note that the problem can be considered from an attacker's perspective as well, where the objective would be to determine the attacking strategies leading to the maximum possible damage on the system. Such a problem can be particularly useful in vulnerability analysis, i.e., to identify the worst possible damage an attacker may introduce to the system and accordingly to take necessary precautions. In the literature, several studies investigate vulnerability analyses using RL, see e.g., @cite_40 for FDI attacks and @cite_27 for sequential network topology attacks. We further note that the problem can also be considered from both defender's and attacker's perspectives simultaneously, that corresponds to a game-theoretic setting.
@cite_27 @cite_40
2513580371 2783173268
Recent studies on sequential attack schemes revealed new smart grid vulnerability that can be exploited by attacks on the network topology. Traditional power systems contingency analysis needs to be expanded to handle the complex risk of cyber-physical attacks. To analyze the transmission grid vulnerability under sequential topology attacks, this paper proposes a Q-learning-based approach to identify critical attack sequences with consideration of physical system behaviors. A realistic power flow cascading outage model is used to simulate the system behavior, where attacker can use the Q-learning to improve the damage of sequential topology attack toward system failures with the least attack efforts. Case studies based on three IEEE test systems have demonstrated the learning ability and effectiveness of Q-learning-based vulnerability analysis. False data injection (FDI) attacks intend to threaten the security of power systems. In this paper, a novel strategy of FDI attacks is proposed, which aims to distort normal operation of a power system regulated by automatic voltage controls (AVCs). Such attacks can be launched from a single substation by the attacker who has little knowledge of the whole power grid. The optimal attack strategy is modeled as a partial observable Markov decision process (POMDP). Then, a @math -learning algorithm with nearest sequence memory is adopted to enable on-line learning and attacking. Stealthy attack strategies are also developed and incorporated into the POMDP model. Various tests are performed upon the IEEE 39-bus systems. Corresponding results verify the efficacy of the proposed attack strategies. The feasibility of independent and data-driven FDI attacks is investigated. Moreover, a bad data detection and correction method are presented based on kernel density estimation to mitigate the disruptive impacts of the proposed FDI attacks. Test results show that this defensive method can help maintain the security of the AVC system, even under heavy system loading.