Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> We propose a computationally efficient approach to detect severe multiple contingencies. We pose a contingency analysis problem using a nonlinear optimization framework, which enables us to detect the fewest possible transmission line outages resulting in a system failure of specified severity, and to identify the most severe system failure caused by removing a specified number of transmission lines from service. Illustrations using a three-bus system and the IEEE 30-bus system aim to exhibit the effectiveness of the proposed approach. <s> BIB001 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> This paper proposes the use of an intrusion detection system (IDS) tailored to counter the threats to an IEC61850-automated substation based upon simulated attacks on intelligent electronic devices (IEDs). Intrusion detection (ID) is the process of detecting a malicious attacker. It is an effective and mature security mechanism. However, it is not harnessed when securing IEC61850-automated substations. The IDS of this paper is developed by using data collected by launching simulated attacks on IEDs and launching packet sniffing attacks using forged address resolution protocol (ARP) packets. The detection capability of the system is then tested by simulating attacks and through genuine user activity. A new method for evaluating the temporal risk of an intrusion for an electric substation based upon the statistical analysis of known attacks is also proposed. <s> BIB002 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> Abstract Ensuring security of systems based on supervisory control and data acquisition (SCADA) is a major challenge. In this paper we analyze the effect of integrity attacks on control systems and provide countermeasure capable of exposing such attacks. To validate the results, we apply our findings to an industrial control problem concerning a chemical plant and then a simplified model of a power system. <s> BIB003 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> Cybersecurity of the substations in a power system is a major issue as the substations become increasingly dependent on computer and communication networks. This paper is concerned with anomaly detection in the computer network environment of a substation. An anomaly inference algorithm is proposed for early detection of cyber-intrusions at the substations. The potential scenario of simultaneous intrusions launched over multiple substations is considered. The proposed detection method considers temporal anomalies. Potential intrusion events are ranked based on the credibility impact on the power system. Snapshots of anomaly entities at substations are described. Simulation results using the modified IEEE 118-bus system have shown the effectiveness of the proposed method for systematic identification. The result of this research is a tool to detect cyber-intrusions that are likely to cause significant damages to the power grid. <s> BIB004 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> The advent of the smart grid promises to usher in an era that will bring intelligence, efficiency, and optimality to the power grid. Most of these changes will occur as an Internet-like communications network is superimposed on top of the current power grid using wireless mesh network technologies with the 802.15.4, 802.11, and WiMAX standards. Each of these will expose the power grid to cybersecurity threats. In order to address this issue, this work proposes a distributed intrusion detection system for smart grids (SGDIDS) by developing and deploying an intelligent module, the analyzing module (AM), in multiple layers of the smart grid. Multiple AMs will be embedded at each level of the smart grid-the home area networks (HANs), neighborhood area networks (NANs), and wide area networks (WANs)-where they will use the support vector machine (SVM) and artificial immune system (AIS) to detect and classify malicious data and possible cyberattacks. AMs at each level are trained using data that is relevant to their level and will also be able to communicate in order to improve detection. Simulation results demonstrate that this is a promising methodology for supporting the optimal communication routing and improving system security through the identification of malicious network traffic. <s> BIB005 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> Smart grid presents the largest growth potential in the machine-to-machine market today. Spurred by the recent advances in M2M technologies, the smart meters/sensors used in smart grid are expected not to require human intervention in characterizing power requirements and energy distribution. These numerous sensors are able to report back information such as power consumption and other monitoring signals. However, SG, as it comprises an energy control and distribution system, requires fast response to malicious events such as distributed denial of service attacks against smart meters. In this article, we model the malicious and/or abnormal events, which may compromise the security and privacy of smart grid users, as a Gaussian process. Based on this model, a novel early warning system is proposed for anticipating malicious events in the SG network. With the warning system, the SG control center can forecast such malicious events, thereby enabling SG to react beforehand and mitigate the possible impact of malicious activity. We verify the effectiveness of the proposed early warning system through computer-based simulations. <s> BIB006 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> Malicious attacks against power systems are investigated, in which an adversary controls a set of meters and is able to alter the measurements from those meters. Two regimes of attacks are considered. The strong attack regime is where the adversary attacks a sufficient number of meters so that the network state becomes unobservable by the control center. For attacks in this regime, the smallest set of attacked meters capable of causing network unobservability is characterized using a graph theoretic approach. By casting the problem as one of minimizing a supermodular graph functional, the problem of identifying the smallest set of vulnerable meters is shown to have polynomial complexity. For the weak attack regime where the adversary controls only a small number of meters, the problem is examined from a decision theoretic perspective for both the control center and the adversary. For the control center, a generalized likelihood ratio detector is proposed that incorporates historical data. For the adversary, the trade-off between maximizing estimation error at the control center and minimizing detection probability of the launched attack is examined. An optimal attack based on minimum energy leakage is proposed. <s> BIB007 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> Electricity theft is estimated to cost billions of dollars per year in many countries. To reduce electricity theft, electric utilities are leveraging data collected by the new Advanced Metering Infrastructure (AMI) and using data analytics to identify abnormal consumption trends and possible fraud. In this paper, we propose the first threat model for the use of data analytics in detecting electricity theft, and a new metric that leverages this threat model in order to evaluate and compare anomaly detectors. We use real data from an AMI system to validate our approach. <s> BIB008 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> Synchrophasor systems will play a significant role in next generation Smart Grid monitoring, protection and control. However, these systems also introduce a multitude of potential vulnerabilities and cyber threats from malicious attackers or disgruntled employees, which may cause erroneous situational awareness or severe damage. This paper proposes a Synchrophasor Specific Intrusion Detection System (SSIDS) for malicious cyber attacks and unintended misuse. The SSIDS involves a heterogeneous whitelist and behaviour-based approach to detect known and unknown attacks. The paper investigates and simulates reconnaissance, Man-in-the-Middle (MITM) and Denial-of-Service (DoS) attacks against a practical synchrophasor system that is used to validate the effectiveness of the proposed SSIDS detection tool. In contrast to previous research in this area that generally has investigated known attacks, this research actively considers the operational features of the IEEE C37.118 protocol and presents a more comprehensive and general solution to deal with not only known attacks but also unknown attacks. <s> BIB009 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> In this paper, a behavior-rule based intrusion detection system (BRIDS) is proposed for securing head-ends (HEs), distribution access points/data aggregation points (DAPs) and subscriber energy meters (SEMs) of a modern electrical grid in which continuity of operation is of the utmost importance. The impact of attacker behaviors on the effectiveness of a behavior-rule intrusion detection design is investigated. Using HEs, DAPs and SEMs as examples, it is demonstrated that a behavior-rule based intrusion detection technique can effectively trade false positives for a high detection probability to cope with sophisticated and hidden attackers to support ultra safe and secure applications. It is shown that BRIDS outperforms contemporary anomaly-based IDSs via comparative analysis. <s> BIB010 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> In smart grids, smart meters may potentially be attacked or compromised to cause certain security risks. It is challenging to identify malicious meters when there are a large number of users. In this paper, we explore the malicious meter inspection (MMI) problem in neighborhood area smart grids. We propose a suite of inspection algorithms in a progressive manner. First, we present a basic scanning method, which takes linear time to accomplish inspection. The scanning method is efficient when the malicious meter ratio is high. Then, we propose a binary-tree-based inspection algorithm, which performs better than scanning when the malicious meter ratio is low. Finally, we employ an adaptive-tree-based algorithm, which leverages advantages of both the scanning and binary-tree inspections. Our approaches are tailored to fit both static and dynamic situations. The theoretical and experimental results have shown the effectiveness of the adaptive tree approach. <s> BIB011 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> We propose new game theoretic approaches to estimate a binary random variable based on sensor measurements that may have been corrupted by a cyber-attacker. The estimation problem is formulated as a zero-sum partial information game in which a detector attempts to minimize the probability of an estimation error and an attacker attempts to maximize this probability. While this problem can be solved exactly by reducing it to the computation of the value of a matrix, this approach is computationally feasible only for a small number of sensors. The two key results of this paper provide complementary computationally efficient solutions to the construction of the optimal detector. The first result provides an explicit formula for the optimal detector but it is only valid when the number of sensors is roughly smaller than two over the probability of sensor errors. In contrast, the detector provided by the second result is valid for an arbitrary number of sensor. While it may result in a probability of estimation error that is ϵ above the minimum achievable, we show that this error ϵ is small when the number of sensors is large, which is precisely the case for which the first result does not apply. <s> BIB012 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> Cyber systems play a critical role in improving the efficiency and reliability of power system operation and ensuring the system remains within safe operating margins. An adversary can inflict severe damage to the underlying physical system by compromising the control and monitoring applications facilitated by the cyber layer. Protection of critical assets from electronic threats has traditionally been done through conventional cyber security measures that involve host-based and network-based security technologies. However, it has been recognized that highly skilled attacks can bypass these security mechanisms to disrupt the smooth operation of control systems. There is a growing need for cyber-attack-resilient control techniques that look beyond traditional cyber defense mechanisms to detect highly skilled attacks. In this paper, we make the following contributions. We first demonstrate the impact of data integrity attacks on Automatic Generation Control (AGC) on power system frequency and electricity market operation. We propose a general framework to the application of attack resilient control to power systems as a composition of smart attack detection and mitigation. Finally, we develop a model-based anomaly detection and attack mitigation algorithm for AGC. We evaluate the detection capability of the proposed anomaly detection algorithm through simulation studies. Our results show that the algorithm is capable of detecting scaling and ramp attacks with low false positive and negative rates. The proposed model-based mitigation algorithm is also efficient in maintaining system frequency within acceptable limits during the attack period. <s> BIB013 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> Cyber intrusions to substations of a power grid are a source of vulnerability since most substations are unmanned and with limited protection of the physical security. In the worst case, simultaneous intrusions into multiple substations can lead to severe cascading events, causing catastrophic power outages. In this paper, an integrated Anomaly Detection System (ADS) is proposed which contains host- and network-based anomaly detection systems for the substations, and simultaneous anomaly detection for multiple substations. Potential scenarios of simultaneous intrusions into the substations have been simulated using a substation automation testbed. The host-based anomaly detection considers temporal anomalies in the substation facilities, e.g., userinterfaces, Intelligent Electronic Devices (IEDs) and circuit breakers. The malicious behaviors of substation automation based on multicast messages, e.g., Generic Object Oriented Substation Event (GOOSE) and Sampled Measured Value (SMV), are incorporated in the proposed network-based anomaly detection. The proposed simultaneous intrusion detection method is able to identify the same type of attacks at multiple substations and their locations. The result is a new integrated tool for detection and mitigation of cyber intrusions at a single substation or multiple substations of a power grid. <s> BIB014 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> The fundamental role of the measurement and control information in the normal operation of smart grids makes cyber-security a critical necessity for existing and future power systems. This paper addresses the problem of detecting data manipulation attacks on smart grids, in the particular context of the data from Phasor Measurement Units (PMUs). The proposed methodology is based on comparing the estimates of the transmission line parameters as obtained from the PMU data with their known values. Data modification attacks are then detected when a statistically significant deviation is observed in the estimated and nominal values. In this proof-of-concept, work-in-progress paper, we verify the proposed detection methodology using mathematical analysis. <s> BIB015 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> Smart grid is a promising power infrastructure that is integrated with communication and information technologies. Nevertheless, privacy and security concerns arise simultaneously. Failure to address these issues will hinder the modernization of the existing power system. After critically reviewing the current status of smart grid deployment and its key cyber security concerns, the authors argue that accountability mechanisms should be involved in smart grid designs. We design two separate accountable communication protocols using the proposed architecture with certain reasonable assumptions under both home area network and neighborhood area network. Analysis and simulation results indicate that the design works well, and it may cause all power loads to become accountable. <s> BIB016 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> By exploiting the communication infrastructure among the sensors, actuators, and control systems, attackers may compromise the security of smart-grid systems, with techniques such as denial-of-service (DoS) attack, random attack, and data-injection attack. In this paper, we present a mathematical model of the system to study these pitfalls and propose a robust security framework for the smart grid. Our framework adopts the Kalman filter to estimate the variables of a wide range of state processes in the model. The estimates from the Kalman filter and the system readings are then fed into the $\chi^{2}$ -detector or the proposed Euclidean detector. The $\chi^{2}$ -detector is a proven effective exploratory method used with the Kalman filter for the measurement of the relationship between dependent variables and a series of predictor variables. The $\chi^{2}$ -detector can detect system faults/attacks, such as DoS attack, short-term, and long-term random attacks. However, the studies show that the $\chi^{2}$ -detector is unable to detect the statistically derived false data-injection attack. To overcome this limitation, we prove that the Euclidean detector can effectively detect such a sophisticated injection attack. <s> BIB017 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> Cyberphysical systems (CPSs) refer to the embedding of widespread sensing, networking, computation, and control into physical spaces with the goal of making them safer, more efficient, and reliable. Driven by the miniaturization and integration of sensing, communication, and computation in cost-efficient devices, CPSs are bound to transform industries such as aerospace, transportation, built environments, energy, health care, and manufacturing, to name a few. This great opportunity, unfortunately, is matched by even greater challenges. Taming the complexity of design and analysis of these systems poses a fundamental problem as a new paradigm is needed to bridge various scientific domains, which, through the years, have developed significantly different formalisms and methodologies. In addition, while the use of dedicated communication networks has so far sheltered systems from the outside world, use of off-the-shelf networking and computing, combined with the unattended operation of a plethora of devices, provides several opportunities for malicious entities to inject attacks on CPSs. A wide variety of motivations exists for launching an attack on CPSs, ranging from economic reasons, such as obtaining a financial gain, all the way to terrorism, for instance, threatening an entire population by manipulating life-critical resources. Any attack on safety-critical CPSs may significantly hamper the economy and lead to the loss of human lives. While the threat of attacks on CPSs tends to be underplayed at times, the Stuxnet worm provided a clear example of the possible future to come. This malware, targeting a uranium enriching facility in Iran, managed to reach the supervisory control and data acquisition (SCADA) system controlling the centrifuges used in the enrichment process. Stuxnet modified the control system, increasing pressure in the centrifuges in a first version of the worm and spinning centrifuges in an erratic fashion in a second version. As a result, Stuxnet caused significant damage to the plant [1]. For details, see "The Stuxnet Attack." <s> BIB018 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> The electrical grid is one of the critical infrastructures of any country whose importance makes them an attractive target for malicious cyber attacks. This paper considers the particular case of data modification attacks in smart grids, where the data generated by Phasor Measurement Units (PMUs) is modified by the adversary in order to introduce errors in the monitoring and control applications that rely on PMU data. The proposed methodology is based on evaluating the equivalent impedance of a transmission line from buses at its either end. The deviations in the magnitude and angle of the equivalent impedances in the presence of a data modification attack are used to detect the attack. Extensive simulations using real PMU data are used to verify the accuracy of the proposed detection mechanism. <s> BIB019 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> Recent investigations have revealed the susceptibility of phasor measurement units (PMUs) to the time synchronization attack by spoofing its global positioning system (GPS). This paper proposes a cross-layer detection mechanism to fight against simultaneous attacks toward multiple PMUs. In the physical layer, we propose a GPS carrier-to-noise ratio (C/No) based spoofing detection technique. We apply the patch-monopole hybrid antenna to two GPS receivers and compute the difference between the standard deviation of each receiver’s C/No. The priori probability of spoofing is calculated from the distributions of the difference. A counter is embedded in the physical layer to identify the most suspicious PMU. In the upper layer, the spoofing attack is considered similarly to the bad data injection toward the power system. A trustworthiness evaluation, which is based on both the physical layer information and power grid measurements, is applied to identify the PMU being attacked. An experiment has been carried to validate the proposed algorithm. <s> BIB020 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> As advanced metering infrastructure (AMI) is responsible for collecting, measuring, and analyzing energy usage data, as well as transmitting this information from a smart meter to a data concentrator and then to a headend system in the utility side, the security of AMI is of great concern in the deployment of smart grid. In this paper, we analyze the possibility of using data stream mining for enhancing the security of AMI through an intrusion detection system (IDS), which is a second line of defense after the primary security methods of encryption, authentication, authorization, etc. We propose a realistic and reliable IDS architecture for the whole AMI system, which consists of individual IDSs for three different levels of AMI's components: smart meter, data concentrator, and AMI headend. We also explore the performances of various existing state-of-the-art data stream mining algorithms on a publicly available IDS data set, namely, the KDD Cup 1999 data set. Then, we conduct a feasibility analysis of using these existing data stream mining algorithms, which exhibit varying levels of accuracies, memory requirements, and running times, for the distinct IDSs at AMI's three different components. Our analysis identifies different candidate algorithms for the different AMI components' IDSs, respectively. <s> BIB021 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> We consider the sequential (i.e., online) detection of false data injection attacks in smart grid, which aims to manipulate the state estimation procedure by injecting malicious data to the monitoring meters. The unknown parameters in the system, namely the state vector, injected malicious data and the set of attacked meters pose a significant challenge for designing a robust, computationally efficient, and high-performance detector. We propose a sequential detector based on the generalized likelihood ratio to address this challenge. Specifically, the proposed detector is designed to be robust to a variety of attacking strategies, and load situations in the power system, and its computational complexity linearly scales with the number of meters. Moreover, it considerably outperforms the existing first-order cumulative sum detector in terms of the average detection delay and robustness to various attacking strategies. For wide-area monitoring in smart grid, we further develop a distributed sequential detector using an adaptive sampling technique called level-triggered sampling. The resulting distributed detector features single bit per sample in terms of the communication overhead, while preserving the high performance of the proposed centralized detector. <s> BIB022 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> Attack detection problems in the smart grid are posed as statistical learning problems for different attack scenarios in which the measurements are observed in batch or online settings. In this approach, machine learning algorithms are used to classify measurements as being either secure or attacked. An attack detection framework is provided to exploit any available prior knowledge about the system and surmount constraints arising from the sparse structure of the problem in the proposed approach. Well-known batch and online learning algorithms (supervised and semisupervised) are employed with decision- and feature-level fusion to model the attack detection problem. The relationships between statistical and geometric properties of attack vectors employed in the attack scenarios and learning algorithms are analyzed to detect unobservable attacks using statistical learning methods. The proposed algorithms are examined on various IEEE test systems. Experimental analyses show that machine learning algorithms can detect attacks with performances higher than attack detection algorithms that employ state vector estimation methods in the proposed attack detection framework. <s> BIB023 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> Synchrophasor systems are an emerging technology. Prior to installation of a synchrophasor system a set of cyber security requirements must be developed, new devices must undergo vulnerability testing, and proper security controls must be designed to protect the synchrophasor system from unauthorised access. This paper describes the process taken to develop a set of cyber security requirements for an American Recovery and Reinvestment Act (ARRA) funded synchrophasor project. The paper further describes vulnerability analysis and testing performed on synchrophasor system components. Finally, the paper describes intrusion detection rules written as a response to vulnerabilities discovered in the vulnerability analysis and testing process. <s> BIB024 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> Nontechnical losses, particularly due to electrical theft, have been a major concern in power system industries for a long time. Large-scale consumption of electricity in a fraudulent manner may imbalance the demand–supply gap to a great extent. Thus, there arises the need to develop a scheme that can detect these thefts precisely in the complex power networks. So, keeping focus on these points, this paper proposes a comprehensive top-down scheme based on decision tree (DT) and support vector machine (SVM). Unlike existing schemes, the proposed scheme is capable enough to precisely detect and locate real-time electricity theft at every level in power transmission and distribution (T&D). The proposed scheme is based on the combination of DT and SVM classifiers for rigorous analysis of gathered electricity consumption data. In other words, the proposed scheme can be viewed as a two-level data processing and analysis approach, since the data processed by DT are fed as an input to the SVM classifier. Furthermore, the obtained results indicate that the proposed scheme reduces false positives to a great extent and is practical enough to be implemented in real-time scenarios. <s> BIB025 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> As one of the key components of the smart grid, advanced metering infrastructure brings many potential advantages such as load management and demand response. However, computerizing the metering system also introduces numerous new vectors for energy theft. In this paper, we present a novel consumption pattern-based energy theft detector, which leverages the predictability property of customers’ normal and malicious consumption patterns. Using distribution transformer meters, areas with a high probability of energy theft are short listed, and by monitoring abnormalities in consumption patterns, suspicious customers are identified. Application of appropriate classification and clustering techniques, as well as concurrent use of transformer meters and anomaly detectors, make the algorithm robust against nonmalicious changes in usage pattern, and provide a high and adjustable performance with a low-sampling rate. Therefore, the proposed method does not invade customers’ privacy. Extensive experiments on a real dataset of 5000 customers show a high performance for the proposed method. <s> BIB026 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> A smart grid is delay sensitive and requires the techniques that can identify and react on the abnormal changes (i.e., system fault, attacker, shortcut, etc.) in a timely manner. In this paper, we propose a real-time detection scheme against false data injection attack in smart grid networks. Unlike the classical detection test, the proposed algorithm is able to tackle the unknown parameters with low complexity and process multiple measurements at once, leading to a shorter decision time and a better detection accuracy. The objective is to detect the adversary as quickly as possible while satisfying certain detection error constraints. A Markov-chain-based analytical model is constructed to systematically analyze the proposed scheme. With the analytical model, we are able to configure the system parameters for guaranteed performance in terms of false alarm rate, average detection delay, and missed detection ratio under a detection delay constraint. The simulations are conducted with MATPOWER 4.0 package for different IEEE test systems. <s> BIB027 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> In this paper, we consider the problems of state estimation and false data injection detection in smart grid when the measurements are corrupted by colored Gaussian noise. By modeling the noise with the autoregressive process, we estimate the state of the power transmission networks and develop a generalized likelihood ratio test (GLRT) detector for the detection of false data injection attacks. We show that the conventional approach with the assumption of Gaussian noise is a special case of the proposed method, and thus the new approach has more applicability. {The proposed detector is also tested on an independent component analysis (ICA) based unobservable false data attack scheme that utilizes similar assumptions of sample observation.} We evaluate the performance of the proposed state estimator and attack detector on the IEEE 30-bus power system with comparison to conventional Gaussian noise based detector. The superior performance of {both observable and unobservable false data attacks} demonstrates the effectiveness of the proposed approach and indicates a wide application on the power signal processing. <s> BIB028 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> Aging power industries, together with the increase in demand from industrial and residential customers, are the main incentive for policy makers to define a road map to the next-generation power system called the smart grid. In the smart grid, the overall monitoring costs will be decreased, but at the same time, the risk of cyber attacks might be increased. Recently, a new type of attacks (called the stealth attack) has been introduced, which cannot be detected by the traditional bad data detection using state estimation. In this paper, we show how normal operations of power networks can be statistically distinguished from the case under stealthy attacks. We propose two machine-learning-based techniques for stealthy attack detection. The first method utilizes supervised learning over labeled data and trains a distributed support vector machine (SVM). The design of the distributed SVM is based on the alternating direction method of multipliers, which offers provable optimality and convergence rate. The second method requires no training data and detects the deviation in measurements. In both methods, principal component analysis is used to reduce the dimensionality of the data to be processed, which leads to lower computation complexities. The results of the proposed detection methods on IEEE standard test systems demonstrate the effectiveness of both schemes. <s> BIB029 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> In this paper, we analyze control-related attacks in supervisory control and data acquisition systems for power grids. This class of attacks introduces a serious threat to power systems, because attackers can directly change the system’s physical configuration using malicious control commands crafted in a legitimate format. To detect such attacks, we propose a semantic analysis framework that integrates network intrusion detection systems with a power flow analysis capable of estimating the execution consequences of control commands. To balance detection accuracy and latency, the parameters of the power flow analysis algorithm are dynamically adapted according to real-time system dynamics. Our experiments on IEEE 24-bus, 30-bus, and 39-bus systems and a 2736-bus system demonstrate that by opening three transmission lines, an attacker can put the tested system into an insecure state, and the semantic analysis can complete detection in 200 ms for the large-scale 2736-bus system with about 0.78% false positives and 0.01% false negatives, which allow for timely responses to intrusions. <s> BIB030 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Detection <s> State estimation is one of the fundamental functions in modern power grid operations that provide operators with situational awareness and is used by several applications like contingency analysis and power markets. Several research in the recent past have highlighted the vulnerability of state estimators to stealthy false data injection attacks that bypass bad data detection mechanisms. They primarily focused on identifying stealthy attack vectors and characterizing their impacts on state estimates. Existing mitigation measures either focus on masking the effect of attacks through redundant measurements or prevent attacks by increasing the cyber security of associated sensors and communication channels. The solutions based on these offline approaches make specific assumptions about the nature of attacks and of the system, which are often restrictive and grossly inadequate to deal with dynamically evolving cyber threats and changing system configurations. In this paper, we propose an online anomaly detection algorithm that utilizes load forecasts, generation schedules, and synchrophasor data to detect measurement anomalies. We provide some insight into the factors that affect the performance of the proposed algorithm. We also describe an empirical method to obtain the minimum attack magnitudes and the detection thresholds for meeting specified false positive and true positive rates. Finally, we evaluated the performance of the proposed algorithm using the IEEE 14 bus power system model for several measures (false positive, false negative, and thresholds). We observed that the best performance of the proposed algorithm relies on finding the right balance between the minimum attack magnitude and detection thresholds. We also observed that the minimum attack magnitudes and detection thresholds could be further improved through the use of a combination of more accurate forecasts and PMU measurements. <s> BIB031
Despite the protection effort, an attacker will still have the advantage to initiate attacks on poorly protected components. In case of such protection failures, IDSs are employed as the major defence mechanisms at the second stage. Signature-and anomaly based IDSs have been developed against known and unknown attack threats, respectively, which are deployed at various layers and locations to detect the traces of imminent attacks. These early warnings allow system operators to react with proper countermeasures and/or emergency plans so the attack impacts can be minimised. At the control centres, generic detection mechanisms have been developed and integrated into CPS control systems. Both model-based BIB003 and game-theoretic BIB012 approaches have been developed to provide effective security enhancement against the CP attacks. Physical watermarking of control inputs is a promising technique to authenticate the integrity of control systems BIB018 . With the physical watermarking, an artificial control noise known only by the operator is injected to produce predictable measurement outputs from the controlled systems. Since the noise is unknown to the attacker, the pattern between the noisy-input and predicted output will be altered and subsequently detected in the presence of an attack. A run-time semantic analysis has also been developed to provide early warnings on altered control commands in the SCADA system BIB030 . With an efficient look-ahead power flow analysis, the semantic analysis simulates the execution consequence of control packets to issue alerts if the execution would result in unfavourable impacts such as line outages. A model-based IDS has been developed against the input attacks on the AGC system BIB013 . The IDS utilises RT load forecast to predict the ACEs over time, and their performances are compared with that of the actual ACEs obtained. With statistical and temporal characterisations of these performance, anomaly detection in the IDS is able to detect scaled and ramped inputs before they are sent into the AGC system. Interdiction in the transmission system maybe observed by effective online contingency screening BIB001 . The nature of these tripping can be further examined by IDSs deployed at substations. A standard-specific IDS for automated substations has been proposed in BIB002 . A dedicated IDS has been developed to identify temporal anomalies induced by multi-substation attacks BIB004 . Host-based and network-based IDSs have been integrated in an innovative strategy against simultaneous multi-substation intrusions BIB014 . While the threat of PMU attacks has only been revealed recently, detection mechanisms have been developed against both manipulation and spoofing attacks on PMU. Innovative IDSs have been proposed against generic manipulations of PMU data based on whitelist/behaviour BIB009 , network topology BIB015 BIB019 , and data mining BIB024 . A comprehensive IDS across both physical and cyber layers has been developed to identify the PMU data attacked by the GPS spoofing BIB020 . Hierarchical IDSs have been developed against CP attacks on the AMI systems based on behaviour rules BIB010 and data stream mining BIB021 . A distributed multi-layer IDS has been proposed in BIB005 , and an early warning system has been developed in BIB006 . Active inspections by the service providers and mutual inspections between the providers and the customers have been developed to effectively detect attacked smart meters BIB011  . To hold a malicious meter accountable in home area networks and neighbourhood area networks, an effective peer-review strategy has been developed in BIB016 . To detect energy thefts, an evaluation of IDSs has been conducted in BIB008 , while machine learning-based IDSs have been recently developed in BIB025 BIB026 . Detection mechanisms against the FDIA schemes have been developed along multiple directions. An integrative Kalman filter-based detector against both bad data and false data has been developed in BIB017 . Instead of a WLS estimator, a Kalman estimator has been implemented in this innovative mechanism. A x 2 -detector is then used to detect the bad data and an Euclidean detector is used to detect the false data. High-performance FDIA detectors have been proposed based on adaptive cumulative sum detection BIB027 and quickest detection BIB022 . An online anomaly detection considering load forecasts, generation schedules, and synchrophasors has also been developed in BIB031 . Furthermore, machine learning approaches have been proposed to identify the false data based on statistic information. Both supervised distributed support vector machine based on alternating direction method of multipliers and semi-supervised anomaly detection based on principal component analysis have been developed recently to classify the false data from the normal data even with incomplete measurements BIB029 . A variety of supervised and semi-supervised classifiers have also been evaluated in BIB023 , which have displayed robust performances in both online and offline scenarios. Using historic data, generalised likelihood ratio detector can provide the optimal detection against weak FDIA schemes when the attacker could not compromise the minimal required number of measurement to construct undetectable FDIA schemes BIB007 BIB028 .