Cyber-physical attacks and defences in the smart grid: a survey <s> Temporal vulnerability <s> Recently, the sequential attack, where multiple malignant contingencies are launched by attackers sequentially, has revealed power grid vulnerability under cascading failures. This paper systematically analyzes properties and features of N-k cascaded- based sequential line-switching attacks using a DC power flow based cascading failure simulator (DC- CFS). This paper first explains the key factors behind cascade-based attacks, then compares three adopted metrics with an original line-margin metric to compute vulnerability indexes and design sequential attacks. Two target search schemes, i.e., offline and online target search in sequential attacks, are also presented. Simulation results of N-2 to N-4 line-switching attacks have suggested that the proposed line margin metric produces stronger sequential attacks, and online target search is more effective than offline search. Reasons behind counter-intuitive load loss resulting from different metrics are also analyzed to facilitate future study on the risk of sequential attacks. <s> BIB001 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Temporal vulnerability <s> The modern society increasingly relies on electrical service, which also brings risks of catastrophic consequences, e.g., large-scale blackouts. In the current literature, researchers reveal the vulnerability of power grids under the assumption that substations/transmission lines are removed or attacked synchronously. In reality, however, it is highly possible that such removals can be conducted sequentially. Motivated by this idea, we discover a new attack scenario, called the sequential attack, which assumes that substations/transmission lines can be removed sequentially, not synchronously. In particular, we find that the sequential attack can discover many combinations of substation whose failures can cause large blackout size. Previously, these combinations are ignored by the synchronous attack. In addition, we propose a new metric, called the sequential attack graph (SAG), and a practical attack strategy based on SAG. In simulations, we adopt three test benchmarks and five comparison schemes. Referring to simulation results and complexity analysis, we find that the proposed scheme has strong performance and low complexity. <s> BIB002 </s> Cyber-physical attacks and defences in the smart grid: a survey <s> Temporal vulnerability <s> Recent studies on sequential attack schemes revealed new smart grid vulnerability that can be exploited by attacks on the network topology. Traditional power systems contingency analysis needs to be expanded to handle the complex risk of cyber-physical attacks. To analyze the transmission grid vulnerability under sequential topology attacks, this paper proposes a Q-learning-based approach to identify critical attack sequences with consideration of physical system behaviors. A realistic power flow cascading outage model is used to simulate the system behavior, where attacker can use the Q-learning to improve the damage of sequential topology attack toward system failures with the least attack efforts. Case studies based on three IEEE test systems have demonstrated the learning ability and effectiveness of Q-learning-based vulnerability analysis. <s> BIB003
CP attacks are largely equipped with the ability to launch multiple remote and coordinated intrusions. While most of the multi-target schemes reviewed in this paper have constructed the attacks in a simultaneous manner, time has been less frequently considered as a relevant factor mostly due to the complexity of time-domain analysis. However, the timing of multiple attacks, particularly for those launched in a sequential manner, is critical to the potential impacts of CP attacks in a realistic scenario. For instance, attacks launched during the peak load and the normal load will most likely result in different impacts on system stability, which shall be responded with different levels of attack awareness. In addition, when an attack vector is successfully injected into the system, the duration it remains undetected and uncleaned will also have a substantial influence of the damage it can exert in the system, as discussed in the feasibility of Aurora attack  . In addition, as revealed in the sequential interdiction on transmission lines and automated substations BIB001 BIB003 BIB002 , the timing and ordering of coordinated sequential attacks will also play an important role in the eventual blackouts. With a proper timing, not only will concurrence be removed as a stringent condition of attack feasibility, but the early warnings of an imminent large-scale attack can be diluted. Nevertheless, informed sequential attacks have still demonstrated the ability to cause greater damages than the concurrent counterparts.