Cyber-physical attacks and defences in the smart grid: a survey <s> PMU attacks: <s> Utilization of phasor measurement units (PMUs) in the monitoring, protection and control of power systems has become increasingly important in recent years. The aim of the optimal PMU placement (OPP) problem is to provide the minimal PMU installations to ensure full observability of the power system. Several methods, based on mathematical and heuristic algorithms, have been suggested for the OPP problem. This paper presents a thorough description of the state of the art of the optimization methods applied to the OPP problem, analyzing and classifying current and future research trends in this field. <s> BIB001 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> PMU attacks: <s> Many operations in power grids, such as fault detection and event location estimation, depend on precise timing information. In this paper, a novel Time Synchronization Attack (TSA) is proposed to attack the timing information in smart grid. Since many applications in smart grid utilize synchronous measurements and most of the measurement devices are equipped with global positioning system (GPS) for precise timing, it is highly probable to attack the measurement system by spoofing the GPS. The effectiveness of TSA is demonstrated for three applications of phasor measurement unit (PMU) in smart grid, namely transmission line fault detection, voltage stability monitoring and event locationing. The validity of TSA is demonstrated by numerical simulations. <s> BIB002 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> PMU attacks: <s> We demonstrate the feasibility of a spoofing attack on the GPS receiver of a phasor measurement unit (PMU). We formulate the attack as an optimization problem where the objective is to maximize the difference between the PMU's receiver clock offset (with respect to the GPS time measured by the onboard satellite clocks) before and after the attack. Since the PMU uses this clock offset to compute a synchronized time stamp for its measurements, an error in the receiver clock offset introduces a proportional phase error in the voltage or current phase measurements provided by the PMU. For the most general case, the decision variables in the optimization problem are the satellites' ephemerides, pseudoranges, and the receiver's Earth-Centered Earth-Fixed (ECEF) coordinates. The constraints are cast such that the decision variables and the satellite positions computed from the solution of the optimization problem are close to their pre-attack values, so as to avoid possible detection schemes that check for large jumps in the values of these variables. We show that the spoofing attack is feasible for any number of visible satellites. As an illustration of the impact of such spoofing attacks, we present simulation results in which the attack induces errors in a real-time voltage stability monitoring algorithm that relies on the phase information from measurements provided by PMUs. <s> BIB003
Compared with the SCADA system, the PMUs are collecting more frequent and accurate measurements for the WAMPAC system BIB001 . Communications with GPS satellites provide time stamps to all PMUs, so that their measurements can be synchronised for significantly enhanced situation awareness in interconnected power systems. However, recent investigations have revealed that the dependence of GPS signals for synchronised measurements can render PMUs vulnerable under spoofing attacks BIB002 BIB003 . Spoofing is the malicious impersonation of a trusted device in the system, which has been used to provide fake time stamps to the PMUs BIB002 . Two types of errors induced by corrupted time stamps have been identified: the phase angle error and the time of arrival (TOA) error. The phase angle error will mislead fault detection and location of transmission lines with an amplitude modulation and create false stability margins with incorrect Thevenin equivalents; the TOA error will result in miscalculation of disturbance event locations that delays or misleads mitigation and restoration effort. The spoofing can also alter the clock offset of a receiving PMU to increase both false alarms and false negatives in voltage stability monitoring systems BIB003 .