Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> A power grid is a complex system connecting electric power generators to consumers through power transmission and distribution networks across a large geographical area. System monitoring is necessary to ensure the reliable operation of power grids, and state estimation is used in system monitoring to best estimate the power grid state through analysis of meter measurements and power system models. Various techniques have been developed to detect and identify bad measurements, including interacting bad measurements introduced by arbitrary, nonrandom causes. At first glance, it seems that these techniques can also defeat malicious measurements injected by attackers. In this article, we expose an unknown vulnerability of existing bad measurement detection algorithms by presenting and analyzing a new class of attacks, called false data injection attacks, against state estimation in electric power grids. Under the assumption that the attacker can access the current power system configuration information and manipulate the measurements of meters at physically protected locations such as substations, such attacks can introduce arbitrary errors into certain state variables without being detected by existing algorithms. Moreover, we look at two scenarios, where the attacker is either constrained to specific meters or limited in the resources required to compromise meters. We show that the attacker can systematically and efficiently construct attack vectors in both scenarios to change the results of state estimation in arbitrary ways. We also extend these attacks to generalized false data injection attacks, which can further increase the impact by exploiting measurement errors typically tolerated in state estimation. We demonstrate the success of these attacks through simulation using IEEE test systems, and also discuss the practicality of these attacks and the real-world constraints that limit their effectiveness. <s> BIB001 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> Data injection attacks to manipulate system state estimators on power grids are considered. A unified formulation for the problem of constructing attacking vectors is developed for linearized measurement models. Based on this formulation, a new low-complexity attacking strategy is shown to significantly outperform naive l1 relaxation. It is demonstrated that it is possible to defend against malicious data injection if a small subset of measurements can be made immune to the attacks. However, selecting such subsets is a high-complexity combinatorial problem given the typically large size of electrical grids. To address the complexity issue, a fast greedy algorithm to select a subset of measurements to be protected is proposed. Another greedy algorithm that facilitates the placement of secure phasor measurement units (PMUs) to defend against data injection attacks is also developed. Simulations on the IEEE test systems demonstrate the benefits of the proposed algorithms. <s> BIB002 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> Malicious attacks against power systems are investigated, in which an adversary controls a set of meters and is able to alter the measurements from those meters. Two regimes of attacks are considered. The strong attack regime is where the adversary attacks a sufficient number of meters so that the network state becomes unobservable by the control center. For attacks in this regime, the smallest set of attacked meters capable of causing network unobservability is characterized using a graph theoretic approach. By casting the problem as one of minimizing a supermodular graph functional, the problem of identifying the smallest set of vulnerable meters is shown to have polynomial complexity. For the weak attack regime where the adversary controls only a small number of meters, the problem is examined from a decision theoretic perspective for both the control center and the adversary. For the control center, a generalized likelihood ratio detector is proposed that incorporates historical data. For the adversary, the trade-off between maximizing estimation error at the control center and minimizing detection probability of the launched attack is examined. An optimal attack based on minimum energy leakage is proposed. <s> BIB003 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> In smart grid, the strong coupling between cyber and physical operations makes power systems vulnerable to cyber attacks. In this paper, stealth false data attacks are investigated where the attackers without prior knowledge of the power grid topology, try to make inferences through phasor observations. We show that when the system dynamics are small and can be approximated linearly, linear independent component analysis (ICA) can be applied to estimate the Jacobian matrix multiplied by the eigenvectors of the covariance matrix of the state variables. The inferred structural information can then be used to launch unobservable attacks. As demonstrated by the simulation results using data generated by MATPOWER, the proposed scheme can indeed inject false data with low detectability. <s> BIB004 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> State estimation is a key element in today's power systems for reliable system operation and control. State estimation collects information from a large number of meter measurements and analyzes it in a centralized manner at the control center. Existing state estimation approaches were traditionally assumed to be able to tolerate and detect random bad measurements. They were, however, recently shown to be vulnerable to intentional false data injection attacks. This paper fully develops the concept of load redistribution (LR) attacks, a special type of false data injection attacks, and analyzes their damage to power system operation in different time steps with different attacking resource limitations. Based on damaging effect analysis, we differentiate two attacking goals from the adversary's perspective, i.e., immediate attacking goal and delayed attacking goal. For the immediate attacking goal, this paper identifies the most damaging LR attack through a max-min attacker-defender model. Then, the criterion of determining effective protection strategies is explained. The effectiveness of the proposed model is tested on a 14-bus system. To the author's best knowledge, this is the first work of its kind, which quantitatively analyzes the damage of the false data injection attacks to power system operation and security. Our analysis hence provides an in-depth insight on effective attack prevention with limited protection resource budget. <s> BIB005 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> This paper introduces new analytical techniques for performing vulnerability analysis of state estimation when it is subject to a hidden false data injection cyber-attack on a power grid's SCADA system. Specifically, we consider ac state estimation and describe how the physical properties of the system can be used as an advantage in protecting the power system from such an attack. We present an algorithm based on graph theory which allows determining how many and which measurement signals an attacker will attack in order to minimize his efforts in keeping the attack hidden from bad data detection. This provides guidance on which measurements are vulnerable and need increased protection. Hence, this paper provides insights into the vulnerabilities but also the inherent strengths provided by ac state estimation and network topology features such as buses without power injections. <s> BIB006 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> False data injection attacks have recently been introduced as an important class of cyber attacks against smart grid's wide area measurement and monitoring systems. These attacks aim to compromise the readings of multiple power grid sensors and phasor measurement units in order to mislead the operation and control centers. Recent studies have shown that if an adversary has complete knowledge on the power grid topology and transmission-line admittance values, he can adjust the false data injection attack vector such that the attack remains undetected and successfully passes the residue-based bad data detection tests that are commonly used in power system state estimation. However, in this paper, we explain that a realistic false data injection attack is essentially an attack with incomplete information due to the attackers lack of real-time knowledge with respect to various grid parameters and attributes such as the position of circuit breaker switches and transformer tap changers and also because of the attacker's limited physical access to most grid facilities. We mathematically characterize false data injection attacks with incomplete information from both the attacker's and grid operator's viewpoints. Furthermore, we introduce a novel vulnerability measure that can compare and rank different power grid topologies against such attacks. To the best of our knowledge, this paper is the first study to investigate false data injection attacks with line admittance uncertainty. <s> BIB007 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> Cyber security is becoming an area of growing concern in the electric power industry with the development of smart grid. False data injection attack, which is against state estimation through SCADA network, has recently attracted wide research interests. This paper further develops the concept of load redistribution (LR) attack, a special type of false data injection attack. The damage of LR attacks to power system operations can manifest in an immediate or a delayed fashion. For the immediate attacking goal, we show in this paper that the most damaging attack can be identified through a max-min attacker-defender model. Benders decomposition within a restart framework is used to solve the bilevel immediate LR attack problem with a moderate computational effort. Its effectiveness has been validated by the Karush-Kuhn-Tucker (KKT)-based method solution in our previous work. For the delayed attacking goal, we propose a trilevel model to identify the most damaging attack and transform the model into an equivalent single-level mixed-integer problem for final solution. In summary, this paper enables quantitative analysis of the damage of LR attacks to power system operations and security, and hence provides an in-depth insight on effective attack prevention when resource budgets are limited. A 14-bus system is used to test the correctness of the proposed model and algorithm. <s> BIB008 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> In the study of power grid security, the cascading failure analysis in multi-contingency scenarios has been a challenge due to its topological complexity and computational cost. Both network analyses and load ranking methods have their own limitations. In this paper, based on self-organizing map (SOM), we propose an integrated approach combining spatial feature (distance)-based clustering with electrical characteristics (load) to assess the vulnerability and cascading effect of multiple component sets in the power grid. Using the clustering result from SOM, we choose sets of heavy-loaded initial victims to perform attack schemes and evaluate the subsequent cascading effect of their failures, and this SOM-based approach effectively identifies the more vulnerable sets of substations than those from the traditional load ranking and other clustering methods. As a result, this new approach provides an efficient and reliable technique to study the power system failure behavior in cascading effect of critical component failure. <s> BIB009 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> Covert data attacks on the network topology of a smart grid is considered. In a so-called man-in-the-middle attack, an adversary alters data from certain meters and network switches to mislead the control center with an incorrect network topology while avoiding detections by the control center. A necessary and sufficient condition for the existence of an undetectable attack is obtained for strong adversaries who can observe all meter and network data. For weak adversaries with only local information, a heuristic method of undetectable attack is proposed. Countermeasures to prevent undetectable attacks are also considered. It is shown that undetectable attacks do not exist if a set of meters satisfying a certain branch covering property are protected. The proposed attacks are tested with IEEE 14-bus and IEEE 118-bus system, and their effect on real-time locational marginal pricing is examined. <s> BIB010 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> A data framing attack is presented to exploit the bad data detection and identification mechanisms at a typical ISO/RTO control center. In particular, the proposed attack frames normal meters as sources of bad data and causes the control center to remove useful measurements from the framed meters. The proposed attack uses subspace information of power system measurements; neither the network topology nor the network parameters are required for constructing the attack. It is shown that the proposed attack is capable of perturbing the power system state estimate by an arbitrary degree using only half of the critical measurements. Implications of this attack on power system operations are discussed, and the attack performance is evaluated using benchmark systems. <s> BIB011 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> It is critical for a power system to estimate its operation state based on meter measurements in the field and the configuration of power grid networks. Recent studies show that the adversary can bypass the existing bad data detection schemes, posing dangerous threats to the operation of power grid systems. Nevertheless, two critical issues remain open: 1) how can an adversary choose the meters to compromise to cause the most significant deviation of the system state estimation, and 2) how can a system operator defend against such attacks? To address these issues, we first study the problem of finding the optimal attack strategy--i.e., a data-injection attacking strategy that selects a set of meters to manipulate so as to cause the maximum damage. We formalize the problem and develop efficient algorithms to identify the optimal meter set. We implement and test our attack strategy on various IEEE standard bus systems, and demonstrate its superiority over a baseline strategy of random selections. To defend against false data-injection attacks, we propose a protection-based defense and a detection-based defense, respectively. For the protection-based defense, we identify and protect critical sensors and make the system more resilient to attacks. For the detection-based defense, we develop the spatial-based and temporal-based detection schemes to accurately identify data-injection attacks. <s> BIB012 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> State estimation in electric power grid is vulnerable to false data injection attacks, and diagnosing such kind of malicious attacks has significant impacts on ensuring reliable operations for power systems. In this paper, the false data detection problem is viewed as a matrix separation problem. By noticing the intrinsic low dimensionality of temporal measurements of power grid states as well as the sparse nature of false data injection attacks, a novel false data detection mechanism is proposed based on the separation of nominal power grid states and anomalies. Two methods, the nuclear norm minimization and low rank matrix factorization, are presented to solve this problem. It is shown that proposed methods are able to identify proper power system operation states as well as detect the malicious attacks, even under the situation that collected measurement data is incomplete. Numerical simulation results both on the synthetic and real data validate the effectiveness of the proposed mechanism. <s> BIB013 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> In modern energy control centers, the Optimal Power Flow (OPF) routine is used to determine individual generator outputs that minimize the overall cost of generation while meeting transmission, generation, and system level operating constraints. OPF relies on the output of another module, namely the state estimator, which computes all the system variables, principally the voltage magnitudes with phase angles, transmission line flows, and the bus (and total system) loads. However, recent works have shown that the widely used weighted least square based state estimation is vulnerable to stealthy attacks wherein an adversary can alter certain measurements to corrupt the estimator's solution, yet remain undetected by the estimator's bad data detection algorithm. Here, we show that an attack on state estimation can compromise the integrity of OPF and undermine the economic and secure system operation. We present a formal verification based framework to systematically investigate the feasibility of such stealthy attacks and their influence on OPF. The proposed approach is described with an illustrative example. We also develop a mechanism to increase the efficiency of executing our model, which is evaluated by running experiments on different IEEE test cases. <s> BIB014 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> The Optimal Power Flow (OPF) routine used in energy control centers allocates individual generator outputs by minimizing the overall cost of generation subject to system level operating constraints. The OPF relies on the outputs of two other modules, namely topology processor and state estimator. The topology processor maps the grid topology based on statuses received from the switches and circuit breakers across the system. The state estimator computes the system state, i.e., voltage magnitudes with phase angles, transmission line flows, and system loads based on real-time meter measurements. However, topology statuses and meter measurements are vulnerable to false data injection attacks. Recent research has shown that such cyber attacks can be launched against state estimation where adversaries can corrupt the states but still remain undetected. In this paper, we show how the stealthy topology poisoning attacks can compromise the integrity of OPF, and thus undermine economic operation. We describe a formal verification based framework to systematically analyze the impact of such attacks on OPF. The proposed framework is illustrated with an example. We also evaluate the scalability of the framework with respect to time and memory requirements. <s> BIB015 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> Power grid is one of the most critical infrastructures in a nation and could suffer a variety of cyber attacks. Recent studies have shown that an attacker can inject pre-determined false data into smart meters such that it can pass the residue test of conventional state estimator. However, the calculation of the false data vector relies on the network (topology and parameter) information of the entire grid. In practice, it is impossible for an attacker to obtain all network information of a power grid. Unfortunately, this does not make power systems immune to false data injection attacks. In this paper, we propose a local load redistribution attacking model based on incomplete network information and show that an attacker only needs to obtain the network information of the local attacking region to inject false data into smart meters in the local region without being detected by the state estimator. Simulations on the modified IEEE 14-bus system demonstrate the correctness and effectiveness of the proposed model. The results of this paper reveal the mechanism of local false data injection attacks and highlight the importance and complexity of defending power systems against false data injection attacks. <s> BIB016 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> This paper discusses malicious false data injection attacks on the wide area measurement and monitoring system in smart grids. First, methods of constructing sparse stealth attacks are developed for two typical scenarios: 1) random attacks in which arbitrary measurements can be compromised; and 2) targeted attacks in which specified state variables are modified. It is already demonstrated that stealth attacks can always exist if the number of compromised measurements exceeds a certain value. In this paper, it is found that random undetectable attacks can be accomplished by modifying only a much smaller number of measurements than this value. It is well known that protecting the system from malicious attacks can be achieved by making a certain subset of measurements immune to attacks. An efficient greedy search algorithm is then proposed to quickly find this subset of measurements to be protected to defend against stealth attacks. It is shown that this greedy algorithm has almost the same performance as the brute-force method, but without the combinatorial complexity. Third, a robust attack detection method is discussed. The detection method is designed based on the robust principal component analysis problem by introducing element-wise constraints. This method is shown to be able to identify the real measurements, as well as attacks even when only partial observations are collected. The simulations are conducted based on IEEE test systems. <s> BIB017 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> New methods that exploit sparse structures arising in smart grid networks are proposed for the state estimation problem when data injection attacks are present. First, construction strategies for unobservable sparse data injection attacks on power grids are proposed for an attacker with access to all network information and nodes. Specifically, novel formulations for the optimization problem that provide a flexible design of the trade-off between performance and false alarm are proposed. In addition, the centralized case is extended to a distributed framework for both the estimation and attack problems. Different distributed scenarios are proposed depending on assumptions that lead to the spreading of the resources, network nodes and players. Consequently, for each of the presented frameworks a corresponding optimization problem is introduced jointly with an algorithm to solve it. The validity of the presented procedures in real settings is studied through extensive simulations in the IEEE test systems. <s> BIB018 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> Data attacks on state estimation modify part of system measurements such that the tempered measurements cause incorrect system state estimates. Attack techniques proposed in the literature often require detailed knowledge of system parameters. Such information is difficult to acquire in practice. The subspace methods presented in this paper, on the other hand, learn the system operating subspace from measurements and launch attacks accordingly. Conditions for the existence of an unobservable subspace attack are obtained under the full and partial measurement models. Using the estimated system subspace, two attack strategies are presented. The first strategy aims to affect the system state directly by hiding the attack vector in the system subspace. The second strategy misleads the bad data detection mechanism so that data not under attack are removed. Performance of these attacks are evaluated using the IEEE 14-bus network and the IEEE 118-bus network. <s> BIB019 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> Accurate state estimation is of paramount importance to maintain normal operations of smart power grids. However, recent research shows that carefully produced attacks with the knowledge of the grid topology, i.e., Jacobian matrix, can bypass the bad data detection (BDD) system. The BDD is used to ensure the integrity of state estimation to filter faulty measurements introduced by device malfunctions or malicious attacks. However, to construct the false data injection attack vectors, a common assumption in most prior works on false data injection attacks is that the attacker has complete knowledge about the power grid topology and transmission-line admittances. By contrast, this paper studies the general problem of blind false data injection attacks using the principal component analysis approximation method without the knowledge of Jacobian matrix and the assumption regarding the distribution of state variables. The proposed attack is proven to be approximately stealthy. ::: 1 ::: The performance of the proposed attack is analyzed. Simulations confirm the performance of the proposed method. <s> BIB020 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> An unobservable false data injection (FDI) attack on AC state estimation (SE) is introduced and its consequences on the physical system are studied. With a focus on understanding the physical consequences of FDI attacks, a bi-level optimization problem is introduced whose objective is to maximize the physical line flows subsequent to an FDI attack on DC SE. The maximization is subject to constraints on both attacker resources (size of attack) and attack detection (limiting load shifts) as well as those required by DC optimal power flow (OPF) following SE. The resulting attacks are tested on a more realistic non-linear system model using AC state estimation and ACOPF, and it is shown that, with an appropriately chosen sub-network, the attacker can overload transmission lines with moderate shifts of load. <s> BIB021 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> The paper assesses the cyber-security of power systems static state estimation (SE) in the possible presence of phasor measurement units (PMUs). Attacks are considered in the Jacobian matrix or the measurement function of the state estimation leading to the presence of coordinated leverage points. Leverage points, which are outliers, constitute a very challenging attack configuration even if randomly present. It is shown that coordinated cyber-attacks when applied to the Jacobian matrix raise major concerns about robust SE. The vulnerability of the least trimmed squares (LTS) estimator, which is robust towards leverage points, is shown. More generally, the weaknesses of robust regression equivariant estimators are discussed if attacks are developed and optimized based on a projection framework. Attack scenarios are outlined considering the number of attacked Jacobian elements, a decomposition of the system to maximize robustness, and whether a DC or AC formulation is used by the operator. Stealthy attacks that stay undetected with respect to the robust LTS are studied. Masked attacks are defined as well. Some possible solutions and remedial actions are proposed. Robust state estimation methods are evaluated and compared in the presence of different configurations of attacks through Monte Carlo simulations on the IEEE 14- and 30-bus test beds. <s> BIB022 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> Potential vulnerabilities in a power grid can be exposed by identifying those transmission lines on which attacks (in the form of interference with their transmission capabilities) causes maximum disruption to the grid. In this study, we model the grid by (nonlinear) AC power flow equations, and assume that attacks take the form of increased impedance along transmission lines. We quantify disruption in several different ways, including (a) overall deviation of the voltages at the buses from 1.0 per unit (p.u.), and (b) the minimal amount of load that must be shed in order to restore the grid to stable operation. We describe optimization formulations of the problem of finding the most disruptive attack, which are either nonlinear programing problems or nonlinear bilevel optimization problems, and describe customized algorithms for solving these problems. Experimental results on the IEEE 118-Bus system and a Polish 2383-Bus system are presented. <s> BIB023 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> Meter measurements in the power grid are susceptible to manipulation by adversaries, that can lead to errors in state estimation. This paper presents a general framework to study attacks on state estimation by adversaries capable of injecting bad-data into measurements and further, of jamming their reception. Through these two techniques, a novel `detectable jamming' attack is designed that changes the state estimation despite failing bad-data detection checks. Compared to commonly studied `hidden' data attacks, these attacks have lower costs and a wider feasible operating region. It is shown that the entire domain of jamming costs can be divided into two regions, with distinct graph-cut based formulations for the design of the optimal attack. The most significant insight arising from this result is that the adversarial capability to jam measurements changes the optimal 'detectable jamming' attack design only if the jamming cost is less than half the cost of bad-data injection. A polynomial time approximate algorithm for attack vector construction is developed and its efficacy in attack design is demonstrated through simulations on IEEE test systems. <s> BIB024 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> A coordinated cyber-attack on grid meter readings and breaker statuses can lead to incorrect state estimation that can subsequently destabilize the grid. This paper studies cyber-attacks by an adversary that changes breaker statuses on transmission lines to affect the estimation of the grid topology. The adversary, however, is incapable of changing the value of any meter data and can only block recorded measurements on certain lines from being transmitted to the control center. The proposed framework, with limited resource requirements as compared to standard data attacks, thus extends the scope of cyber-attacks to grids secure from meter corruption. We discuss necessary and sufficient conditions for feasible attacks using a novel graph-coloring based analysis and show that an optimal attack requires breaker status change at only ONE transmission line. The potency of our attack regime is demonstrated through simulations on IEEE test cases. <s> BIB025 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> Key smart grid operational module like state estimator is highly vulnerable to a class of data integrity attacks known as 'False Data Injection FDI'. Although most of the existing FDI attack construction strategies require the knowledge of the power system topology and electric parameters e.g., line resistance and reactance, this paper proposes an alternative data-driven approach. We show that an attacker can construct stealthy attacks using only the subspace information of the measurement signals without requiring any prior power system knowledge. However, principle component analysis PCA or singular value decomposition SVD based attack construction techniques do not remain stealthy if measurement signals contain missing values. We demonstrate that even in that case an intelligent attacker is able to construct the stealthy FDI attacks using low-rank and sparse matrix approximation techniques. We illustrate an attack example using augmented lagrange multiplier ALM method approach. These attacks remain hidden in the existing bad data detection modules and affect the operation of the physical energy grid. IEEE benchmark test systems, different attack scenarios and state-of-the-art detection techniques are considered to validate the proposed claims. <s> BIB026 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> Multiple attacker data-injection attack construction in electricity grids with minimum-mean-square-error state estimation is studied for centralized and decentralized scenarios. A performance analysis of the trade-off between the maximum distortion that an attack can introduce and the probability of the attack being detected by the network operator is considered. In this setting, optimal centralized attack construction strategies are studied. The decentralized case is examined in a game-theoretic setting. A novel utility function is proposed to model this trade-off and it is shown that the resulting game is a potential game. The existence and cardinality of the corresponding set of Nash equilibria of the game is analyzed. Interestingly, the attackers can exploit the correlation among the state variables to facilitate the attack construction. It is shown that attackers can agree on a data-injection vector construction that achieves the best trade-off between distortion and detection probability by sharing only a limited number of bits offline. For the particular case of two attackers, numerical results based on IEEE test systems are presented. <s> BIB027 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> This paper studies the physical consequences of a class of unobservable state-and-topology cyber-physical attacks in which both state and topology data for a sub-network of the network are changed by an attacker to mask a physical attack. The problem is formulated as a two-stage optimization problem, which aims to cause overload in a line of the network with limited attack resources. It is shown that unobservable state-and-topology cyber-physical attacks as studied in this paper can make the system operation more vulnerable to line outages and failures. <s> BIB028 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> Jamming refers to the deletion, corruption or damage of meter measurements that prevents their further usage. This is distinct from adversarial data injection that changes meter readings while preserving their utility in state estimation. This paper presents a generalized attack regime that uses jamming of secure and insecure measurements to greatly expand the scope of common 'hidden' and 'detectable' data injection attacks in literature. For 'hidden' attacks, it is shown that with jamming, the optimal attack is given by the minimum feasible cut in a specific weighted graph. More importantly, for 'detectable' data attacks, this paper shows that the entire range of relative costs for adversarial jamming and data injection can be divided into three separate regions, with distinct graph-cut based constructions for the optimal attack. Approximate algorithms for attack design are developed and their performances are demonstrated by simulations on IEEE test cases. Further, it is proved that prevention of such attacks require security of all grid measurements. This work comprehensively quantifies the dual adversarial benefits of jamming: (a) reduced attack cost and (b) increased resilience to secure measurements, that strengthen the potency of data attacks. <s> BIB029 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> Today’s power systems become more prone to cyber-attacks due to the high integration of information technologies. In this paper, we demonstrate that the outages of some lines can be masked by injecting false data into a set of measurements. The success of the topology attack can be guaranteed by making that: 1) the injected false data obeys Kirchhoff current law and Kirchhoff voltage law to avoid being detected by the bad data detection program in the state estimation and 2) the residual in the line outage detection is increased such that the line outage cannot be detected by phasor measurement unit data. A bilevel optimization problem is set up to determine the optimal attack vector that can maximize the residual of the outaged line. The IEEE 39-bus and 118-bus systems are used to demonstrate the masking scheme. <s> BIB030 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> This paper analyzes a coordinated cyber–physical attack on power systems, which could lead to undetectable line outages. Coordinated with physical attacks that cause line outages, the two-step cyberattacks comprising topology preserving and load redistribution attacks could mask and potentially exasperate outages to trigger cascading failures. These coordinated cyber–physical attacks are analyzed in a proposed bilevel model, which aims at identifying the most damaging and undetectable physical attacks constrained by attackers’ total budget. After being transformed into a mixed-integer linear programming problem, the proposed bilevel model is solved by a rigorous two-stage solution approach. This paper also discusses the relevant countermeasure strategies. The proposed model, the solution algorithm, and the effectiveness of countermeasures are examined by case studies based on the IEEE 14- and 118-bus test systems. <s> BIB031 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> With rapid advances in sensor, computer, and communication networks, modern power systems have become complicated cyber-physical systems. Assessing and enhancing cyber-physical system security is, therefore, of utmost importance for the future electricity grid. In a successful false data injection attack (FDIA), an attacker compromises measurements from grid sensors in such a way that undetected errors are introduced into estimates of state variables such as bus voltage angles and magnitudes. In evading detection by commonly employed residue-based bad data detection tests, FDIAs are capable of severely threatening power system security. Since the first published research on FDIAs in 2009, research into FDIA-based cyber-attacks has been extensive. This paper gives a comprehensive review of state-of-the-art in FDIAs against modern power systems. This paper first summarizes the theoretical basis of FDIAs, and then discusses both the physical and the economic impacts of a successful FDIA. This paper presents the basic defense strategies against FDIAs and discusses some potential future research directions in this field. <s> BIB032 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> It has been shown that an attacker can stealthily launch false data injection attacks against the state estimation without knowing the full topology and parameter information of the entire power network. In this paper, we propose a heuristic yet effective method to determine a feasible attacking region of a single line, which requires less network information. We use six IEEE standard systems to validate the proposed attacking strategy. This paper can reveal the vulnerability of the real-time topology of a power grid and is very helpful to develop effective protection strategies against topology attacks in smart grids. <s> BIB033 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> Power systems are being exposed to cyber-attacks due to the high integration of information technology and the vulnerability of communication networks. Existing false data attacks research focus on dc state estimation. In this paper, we show that an attacker can construct an undetectable attack vector against ac state estimation based on a few measurements in the attacking region associated with boundary buses without knowing the full topology and parameter information of the entire power network. An iteration approach is adopted to obtain the attack vector. The simulations on the IEEE 14-bus and 118-bus systems are used to demonstrate the correctness and effectiveness of the proposed attack scheme. This paper provides a basis to study the attack behaviors under the ac case, and a theoretical guide to develop protection strategies and detection methods. <s> BIB034 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> The increased complexity of power system makes the power dispatch heavily rely on the condition monitoring and state estimation functions. However, with the massive deployment of cyber technologies, the power grid is becoming more vulnerable to malicious cyber attacks, including various kinds of false data injection attacks. This paper quantifies the influence of load redistribution (LR) attack on the long-term power supply reliability. The intrusion process for manipulating the measurements is modeled by the semi-Markov models. Considering the practical cross-check for suspicious measurements, the regional LR attack model is proposed. A holistic framework incorporating the physical failures and the LR attack is proposed for cyber-physical power system reliability evaluation. The simulation is carried out on the IEEE RTS79 system. The influences of critical factors and strategies are analyzed. It is concluded that the LR attacks have a non-negligible impact on the power system reliability. <s> BIB035 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> State estimation attacks: <s> Modern power system becomes more prone to cyber attacks due to the high integration of information technology and communication network. In this paper, we investigate the impact of multiple solutions to the security constrained economic dispatch, a tool used by power system operators to ensure the economics and security of the system operation, on the line attacking strategy, and model the line cyber-attack problem as a trilevel mixed integer linear programming problem. We convert the middle and lower levels into a single-level optimization problem using a weighting factor without introducing any additional variables and constraints. The simulation results on the modified IEEE 14-bus system verify the correctness of the proposed model. <s> BIB036
The SE is a core function in the smart grid that has been shown to be vulnerable to a large number of CP attack schemes. As shown in Fig. 6 , SE is the entry function that processes the raw measurements of system topology and dynamics to obtain accurate estimation of the state variables for various subsequent EMS applications  . In a linear direct-current (DC) model, the fundamental SE problem can be written as where z is the measurement vector, x is the state vector, n is a white Gaussian measurement noise, and H is the Jacobian matrix built on system topology. The estimation problem is commonly solved by the weighted least square (WLS) method. In practise, bad data from faulty sensor and missing data will degrade the estimation accuracy. Residual-based x 2 -test and largest normalised residual test have been employed in the bad data detection and elimination (BDDE) process to remove such bad data from the measurements. The false data injection attack (FDIA) is a notorious family of CP attacks targeting a vulnerability in the residual-based BDDE system. Assume that a malicious attacker has the ability to inject a false data vector a into the measurements, which in the form of z a = z + a. BIB009 . Distant substations from each of the coloured self-organised regions form a critical victim set that could result in massive blackouts in the system The FDIA scheme has revealed that, given the full knowledge of the Jacobian H, an attack vector a undetectable by BDDE can be generated BIB001 . The stealth attack vector is given in the form of a = Hc, where c is the false state vector. The sufficient and necessary condition of the existence of an undetectable attack vector has been proved in BIB010 . While the scheme was originally proposed based on the DC model of SE, it has also subsequently extended to the AC-based SE BIB006 . A recent survey BIB032 has provided a summary of the state-of-the-art in FDIA, while this paper would like to highlight three major objectives in the existing FDIA schemes: Objective 1: Least-effort attacks: Find the sparsest attack vector with the least number of measurements to be compromised. Objective 2: Least-information attacks: Find the attack vector with the least required information of system topology. Objective 3: Target-specific attacks: Find the attack vector toward a specific post-attack effect. For Objective 1, finding the least-effort attack is NP-hard problem BIB012 , and the solution is dependent on the system topology. To effectively identify the minimal stealth attack, schemes have been developed based on heuristic BIB001 , greedy BIB002 BIB017 , graph theoretic BIB003 , and sparse optimisation BIB018 BIB013 . For Objective 2, investigations have revealed that an undetectable attack vector can be constructed without the complete information of H. Stealth FDIA schemes with incomplete information have been developed based on graph method BIB007 and data-driven approaches BIB026 BIB019 . Even without the knowledge of H, investigations have shown that historic measurements can still be used to construct an undetectable FDIA BIB004 BIB020 . For Objective 3, FDIA has been utilised to exert specific damages. The maximal SE error can be obtained by solving a potential game with a minimal detection rate BIB027 . Errors can be propagated into the OPF solutions through customised FDIA schemes BIB014 BIB015 . Line overloading can be further induced the erroneous OPF solution BIB021 . Target-specific FDIA schemes have also been developed systematically to induce load redistribution (LR) in the transmission systems and transmission congestion in the electricity markets to induce operational costs and obtain financial arbitrages, respectively. Detail introductions on both families of FDIA schemes will be provided later in this section. Other than the FDIA schemes, it is notable that (4) also reveals other SE vulnerabilities. Instead of the measurement vector, the Jacobian matrix H can also be compromised to forge a false data BIB022 . Attacking the line impedance alone will also induce misinformed voltage deviations and load shedding BIB023 . A two-stage optimisation for undetectable state-and-topology attack has been developed in BIB028 , which has effectively increased the risk of line outages. In contrast to the construction of undetectable attack vectors, malicious attackers can also intentionally create detectable false data to reduce the availability of measurements. As the BDDE consistently removes bad data from the measurements, an attacker can manipulate the measurements to frame good data so they would be incorrectly removed BIB011 . In contrast to the FDIA schemes, framing requires no information on the topology or parameters of the system; a subset of the measurements provides sufficient information to manipulate the normal data into bad data. The scheme effectively increases the SE error by an arbitrary degree while the number of measurements to be corrupted has been significantly reduced. An advanced jamming strategy has been proposed to obtain an optimal scheme in the presence of protected measurements based on recursive min-cut BIB024 . Further investigation has indicated that the jamming attack is effective unless all measurements have been secured BIB029 . In addition, the availability of status data can also be reduced by the jamming attack, in which attacking a single circuit breaker on a transmission line could effectively perturb the SE without corrupting any measurements BIB025 . 3.3.6 Load redistribution attacks: LR attack is a variant of target-specific FDIA schemes BIB005 BIB008 . With the knowledge of system topology and dynamics, the injected false data can be crafted intentionally to redistribute individual bus load in the system without changing the overall load demands. Both the location and the quantity of the stealth injection can be solved precisely by the proposed schemes to induce immediate and delayed operational costs from the redistributed load demand. A concept of attacking region has been proposed to construct an LR attack with incomplete information BIB016 . The attacking region can be effectively localised into the vicinity of a target transmission line BIB033 . The concept has also been utilised to identify attack vectors in the AC SE with incomplete information BIB034 . A recent investigation has validated the non-negligible impact on the power system reliability from the LR attacks BIB035 . Investigations have demonstrated that the LR attacks can be utilised to construct coordinated multi-stage schemes BIB030 BIB031 BIB036 . First, a designated scheme has been proposed to mask the occurrence of line outages to the system operator BIB030 . The masking attack has been further utilised to conceal line outages created by the LR attack. A bi-level optimisation problem has been formulated for this combined scheme with consideration of the defender's responses BIB031 . The scheme has been further developed into a tri-level optimisation problem against the security constrained ED in the EMS BIB036 . It has been revealed that an attacker is capable of identifying an effective scheme to create line overloading in the system, even if the operator implements a dedicated multi-solution strategy against the LR attacks. These serial LR schemes have illustrated that CP attacks can be orchestrated to compose sophisticated multi-stage schemes with severe impacts.