A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Power Systems <s> A Cyber Security Study of a SCADA Energy Management System : Stealthy Deception Attacks on the State Estimator <s> BIB001 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Power Systems <s> State estimators in power systems are currently used to, for example, detect faulty equipment and to route power flows. It is believed that state estimators will also play an increasingly important role in future smart power grids, as a tool to optimally and more dynamically route power flows. Therefore security of the estimator becomes an important issue. The estimators are currently located in control centers, and large numbers of measurements are sent over unencrypted communication channels to the centers. We here study stealthy false-data attacks against these estimators. We define a security measure tailored to quantify how hard attacks are to perform, and describe an efficient algorithm to compute it. Since there are so many measurement devices in these systems, it is not reasonable to assume that all devices can be made encrypted overnight in the future. Therefore we propose two algorithms to place encrypted devices in the system such as to maximize their utility in terms of increased system security. We illustrate the effectiveness of our algorithms on two IEEE benchmark power networks under two attack and protection cost models. <s> BIB002 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Power Systems <s> The problem of constructing malicious data attack of smart grid state estimation is considered together with countermeasures that detect the presence of such attacks. For the adversary, using a graph theoretic approach, an efficient algorithm with polynomial-time complexity is obtained to find the minimum size unobservable malicious data attacks. When the unobservable attack does not exist due to restrictions of meter access, attacks are constructed to minimize the residue energy of attack while guaranteeing a certain level of increase of mean square error. For the control center, a computationally efficient algorithm is derived to detect and localize attacks using the generalized likelihood ratio test regularized by an L_1 norm penalty on the strength of attack. <s> BIB003 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Power Systems <s> State estimation is an important power system application that is used to estimate the state of the power transmission networks using (usually) a redundant set of sensor measurements and network topology information. Many power system applications such as contingency analysis rely on the output of the state estimator. Until recently it was assumed that the techniques used to detect and identify bad sensor measurements in state estimation can also thwart malicious sensor measurement modification. However, recent work by Liu et al. [1] demonstrated that an adversary, armed with the knowledge of network configuration, can inject false data into state estimation that uses DC power flow models without being detected. In this work, we explore the detection of false data injection attacks of [1] by protecting a strategically selected set of sensor measurements and by having a way to independently verify or measure the values of a strategically selected set of state variables. Specifically, we show that it is necessary and sufficient to protect a set of basic measurements to detect such attacks. <s> BIB004 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Power Systems <s> In this paper, we study stealthy false-data attacksagainst state estimators in power networks. The focus ison applications in SCADA (Supervisory Control and DataAcquisition) systems where measurement data is corrupted bya malicious attacker. We introduce two security indices for thestate estimators. The indices quantify the least effort neededto achieve attack goals while avoiding bad-data alarms in thepower network control center (stealthy attacks). The indicesdepend on the physical topology of the power network and theavailable measurements, and can help the system operator toidentify sparse data manipulation patterns. This informationcan be used to strengthen the security by allocating encryptiondevices, for example. The analysis is also complemented witha convex optimization framework that can be used to evaluatemore complex attacks taking model deviations and multipleattack goals into account. The security indices are finallycomputed in an example. It is seen that a large measurementredundancy forces the attacker to use large magnitudes in thedata manipulation pattern, but that the pattern still can be relatively sparse. <s> BIB005 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Power Systems <s> In this paper, we analyze the cyber security of state estimators in Supervisory Control and Data Acquisition (SCADA) systems operating in power grids. Safe and reliable operation of these critical infrastructure systems is a major concern in our society. In current state estimation algorithms there are bad data detection (BDD) schemes to detect random outliers in the measurement data. Such schemes are based on high measurement redundancy. Although such methods may detect a set of very basic cyber attacks, they may fail in the presence of a more intelligent attacker. We explore the latter by considering scenarios where deception attacks are performed, sending false information to the control center. Similar attacks have been studied before for linear state estimators, assuming the attacker has perfect model knowledge. Here we instead assume the attacker only possesses a perturbed model. Such a model may correspond to a partial model of the true system, or even an out-dated model. We characterize the attacker by a set of objectives, and propose policies to synthesize stealthy deceptions attacks, both in the case of linear and nonlinear estimators. We show that the more accurate model the attacker has access to, the larger deception attack he can perform undetected. Specifically, we quantify trade-offs between model accuracy and possible attack impact for different BDD schemes. The developed tools can be used to further strengthen and protect the critical state-estimation component in SCADA systems. <s> BIB006 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Power Systems <s> A power grid is a complex system connecting electric power generators to consumers through power transmission and distribution networks across a large geographical area. System monitoring is necessary to ensure the reliable operation of power grids, and state estimation is used in system monitoring to best estimate the power grid state through analysis of meter measurements and power system models. Various techniques have been developed to detect and identify bad measurements, including interacting bad measurements introduced by arbitrary, nonrandom causes. At first glance, it seems that these techniques can also defeat malicious measurements injected by attackers. In this article, we expose an unknown vulnerability of existing bad measurement detection algorithms by presenting and analyzing a new class of attacks, called false data injection attacks, against state estimation in electric power grids. Under the assumption that the attacker can access the current power system configuration information and manipulate the measurements of meters at physically protected locations such as substations, such attacks can introduce arbitrary errors into certain state variables without being detected by existing algorithms. Moreover, we look at two scenarios, where the attacker is either constrained to specific meters or limited in the resources required to compromise meters. We show that the attacker can systematically and efficiently construct attack vectors in both scenarios to change the results of state estimation in arbitrary ways. We also extend these attacks to generalized false data injection attacks, which can further increase the impact by exploiting measurement errors typically tolerated in state estimation. We demonstrate the success of these attacks through simulation using IEEE test systems, and also discuss the practicality of these attacks and the real-world constraints that limit their effectiveness. <s> BIB007 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Power Systems <s> Coordinated cyberattacks of power meter readings can be arranged to be undetectable by any bad data detection algorithm in the power system state estimation process. These unobservable attacks present a potentially serious threat to grid operations. Of particular interest are sparse attacks that involve the compromise of a modest number of meter readings. An efficient algorithm to find all unobservable attacks [under standard DC load flow approximations] involving the compromise of exactly two power injection meters and an arbitrary number of line power meters is presented. This requires O(n2m) flops for a power system with n buses and m line meters. If all lines are metered, there exist canonical forms that characterize all 3, 4, and 5-sparse unobservable attacks. These can be quickly detected in power systems using standard graph algorithms. Known-secure phasor measurement units [PMUs] can be used as countermeasures against an arbitrary collection of cyberattacks. Finding the minimum number of necessary PMUs is NP-hard. It is shown that p + 1 PMUs at carefully chosen buses are sufficient to neutralize a collection of p cyberattacks. <s> BIB008 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Power Systems <s> Data injection attacks to manipulate system state estimators on power grids are considered. A unified formulation for the problem of constructing attacking vectors is developed for linearized measurement models. Based on this formulation, a new low-complexity attacking strategy is shown to significantly outperform naive l1 relaxation. It is demonstrated that it is possible to defend against malicious data injection if a small subset of measurements can be made immune to the attacks. However, selecting such subsets is a high-complexity combinatorial problem given the typically large size of electrical grids. To address the complexity issue, a fast greedy algorithm to select a subset of measurements to be protected is proposed. Another greedy algorithm that facilitates the placement of secure phasor measurement units (PMUs) to defend against data injection attacks is also developed. Simulations on the IEEE test systems demonstrate the benefits of the proposed algorithms. <s> BIB009 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Power Systems <s> Bad measurement data exists in power systems for a number of reasons. Malicious data injection attacks, which alter the values of measurements without being detected, are one potential cause of bad data and may have serious consequences. A solution for bad data detection in power systems is proposed in this work, particularly designed to detect malicious data attacks. By applying known perturbations to the system and measuring the changes elsewhere, the approach 'probes' the system for unexpected responses in terms of measurement values. Using a developed 'key space' approach, the perturbation used is rendered unpredictable to the attacker, making it difficult for the attacker to adapt his attacks. Thus, unexpected measurement values after a probe provide an indication of both bad and malicious data. The proposed approach is analyzed for sample systems using MATLAB. <s> BIB010 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Power Systems <s> In this paper, we present two contributions to false data injection attacks and mitigation in electric power systems. First, we introduce a method of creating unobservable attacks on the AC power flow equations. The attack strategy details how an adversary can launch a stealthy attack to achieve a goal. Then, we introduce a proactive defense strategy that is capable of detecting attacks. The defense strategy introduces known perturbations by deliberately probing the system in a specific, structured manner. We show that the proposed approach, under certain conditions, is able to detect the presence of false data injection attacks, as well the attack locations and information about the manipulated data values. <s> BIB011 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Power Systems <s> The power system state estimation is very important for maintaining the power system securely, reliably, and efficiently. An attacker can compromise meters or communication systems and introduce false measurements, which can evade existing bad data detection algorithms and lead to incorrect state estimation. This kind of stealthy attack is well-known as Undetected False Data Injection (UFDI) attack. However, attackers usually have different constraints with respect to knowledge, capabilities, resources, and attack targets. These attack attributes are important to consider in order to know the potential attack vectors. In this paper, we propose a formal model for UFDI attack verification in order to provide security analytics for power grid state estimation. Our model formalizes the grid information and different constraints, particularly with respect to attackers' point of view. The solution to the model provides an attack vector, when it exists, by satisfying the given constraints. We demonstrate our UFDI attack verification model with the help of an example. We evaluated our proposed model by running experiments on different IEEE test systems and we found that our model is very efficient in solving problems with hundreds of buses. <s> BIB012 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Power Systems <s> State estimation plays an essential role in the monitoring and control of power transmission systems. In modern, highly inter-connected power systems the state estimation should be performed in a distributed fashion and requires information exchange between the control centers of directly connected systems. Motivated by recent reports on trojans targeting industrial control systems, in this paper we investigate how a single compromised control center can affect the outcome of distributed state estimation. We describe five attack strategies, and evaluate their impact on the IEEE 118 benchmark power system. We show that that even if the state estimation converges despite the attack, the estimate can have up to 30% of error, and bad data detection cannot locate the attack. We also show that if powerful enough, the attack can impede the convergence of the state estimation, and thus it can blind the system operators. Our results show that it is important to provide confidentiality for the measurement data in order to prevent the most powerful attacks. Finally, we discuss a possible way to detect and to mitigate these attacks. <s> BIB013 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Power Systems <s> An algorithm is developed to construct unobservable attacks for an AC state estimator (SE). It is shown that unobservability of the attack, in the absence of noise, is guaranteed when the attacker exploits its local network knowledge to perform AC SE locally than the simpler DC SE often assumed in the literature. Finally, the consequences of such an unobservable attack are highlighted via a scenario in which the physical system is changed due to false data injection. <s> BIB014 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Power Systems <s> Cyber systems play a critical role in improving the efficiency and reliability of power system operation and ensuring the system remains within safe operating margins. An adversary can inflict severe damage to the underlying physical system by compromising the control and monitoring applications facilitated by the cyber layer. Protection of critical assets from electronic threats has traditionally been done through conventional cyber security measures that involve host-based and network-based security technologies. However, it has been recognized that highly skilled attacks can bypass these security mechanisms to disrupt the smooth operation of control systems. There is a growing need for cyber-attack-resilient control techniques that look beyond traditional cyber defense mechanisms to detect highly skilled attacks. In this paper, we make the following contributions. We first demonstrate the impact of data integrity attacks on Automatic Generation Control (AGC) on power system frequency and electricity market operation. We propose a general framework to the application of attack resilient control to power systems as a composition of smart attack detection and mitigation. Finally, we develop a model-based anomaly detection and attack mitigation algorithm for AGC. We evaluate the detection capability of the proposed anomaly detection algorithm through simulation studies. Our results show that the algorithm is capable of detecting scaling and ramp attacks with low false positive and negative rates. The proposed model-based mitigation algorithm is also efficient in maintaining system frequency within acceptable limits during the attack period. <s> BIB015
The area of power systems has also been the subject of intense study due to the criticality of the power grid. One of the most active areas of research by the power systems community is the problem of bad data detection in state estimation. Interestingly enough, the first paper on this research topic was published in a cyber-security conference BIB007 and was later extended in a cyber-security journal BIB007 ; however, because this paper motivated several researchers with power systems background to continue this line of research, we are including it along with the other power systems papers. Attacks on Bad Data Detection. One of the most popular lines of work in the power systems community is the study of false-data injection attacks against state estimation in the power grid. In the power grid, operators need to estimate the phase angles x k from the measured power flow y k in the transmission grid. These bad data detection algorithms were meant to detect random sensor faults, not strategic attacks, and as Liu et al. BIB007 BIB007 showed, it is possible for an attacker to create false sensor signals that will not raise an alarm (experimental validation in software used by the energy sector was later confirmed BIB001 ). Attack Detection: It is known that the measured power flow y k = h(x k ) + e k is a nonlinear noisy measurement of the state of the system x and an unknown quantity e k called the measurement error. Liu et al. considered the linear model where y k = Cx k + e k , therefore this model of the physical system is the sensor measurement SLS model described by Equation (2), where the matrix D is zero and where the dynamic state equation is not specified. The detection mechanism they consider is a stateless anomaly detection test, where the residual is r k = y k − Cx k , the state estimate is defined asx k = (C T W −1 C) −1 C T W −1 y k , andW is the covariance matrix of the measurement noise e k . Note that because r k is a vector, the metric | · | is a vector distance metric, rather than the absolute value. This test is also illustrated in the middle row of Figure 8 . Attack Location: The sensor data is manipulated, and cannot be trusted. The goal of the attacker is to create false sensor measurements such that |r k | < τ . Validation: The paper uses a metric that focuses on how hard it is for the adversary to find attacks such that |r k | < τ . The results are validated using simulation results. There has been a significant amount of follow up research focusing on false data injection for state estimation in the power grid, including the work of Dán and Sandberg BIB002 , who study the problem of identifying the best k sensors to protect to minimize the impact of attacks (they assume the attacker cannot compromise these sensors). Kosut et al. BIB003 consider attackers trying to minimize the error introduced in the estimate, and defenders with a new detection algorithm that attempts to detect false data injection attacks. Liang et al. BIB014 consider the nonlinear observation model y k = h(x k ) + e k . Further work includes BIB004 BIB008 BIB009 BIB012 BIB005 BIB006 BIB013 . Automatic Generation Control. While attacks to state estimation can be dangerous, even more catastrophic to the power grid would be an attack against the Automatic Generation Control (AGC) signal, as this signal controls the power generation of the bulk power grid. An incorrect AGC signal can cause large transmission systems disconnecting from each other and cause severe blackouts. To compute the AGC signal to be sent to generators, control centers in the power grid send Area Control Error (ACE) signals to ramp up or ramp down generation based on the state of the grid. Sridhar and Govindarasu BIB015 were one of the first to consider the case when an ACE signal that cannot be trusted. For Attack Detection, they use a historical model of how real-time load forecast affects ACE. The ACE computed by the control center (ACE R ) and the one computed from the forecast (ACE F ) are then compared to compute the residual. They add the residuals for a time window and then raise an alarm if it exceeds a threshold. Attack Location: The load forecast is trusted but the control ACE signal is not, so the attacker either compromises a machine computing the ACE signal or a control center. For Validation, the proposed approach is implemented using simulations, and they use the false positive and false negative detection rates as metrics of performance. Active Monitoring. Similar to the active monitoring papers we discussed earlier in the article, the works of Morrow et al. BIB010 and Davis et al. BIB011 consider active monitoring, for power systems. Attack location: Adversaries are able to compromise a subset of sensor readings and can design attacks that bypass the anomaly detection strategy. Anomaly Detection: The focus is on static linear models of the flow equations of the power grid to generate estimations that are used by an stateless anomaly detection algorithm. In particular, the proposed active monitoring strategy changes randomly the topology of the power grid to increase the effort of an adversary that wants to remain undetected, because this reconfiguration will change the state of the system and if the adversary does not change attack appropriately, then it will be detected. Validation: Different benchmarks were simulated to verify the proposed strategy. While the idea of perturbing the system to reveal attackers that do not adapt to these perturbations is intuitively appealing, it also comes with a big operational cost to power systems: the deviation of a system from an ideal operational state just to test if the sensors have been compromised or not might not sound very appealing to asset owners whose livelihood depends on the optimal operation of a system. However, there is another way to look at this idea: if the control signal u k is already highly variable (e.g., in the control of frequency generators in the power grid who need to react to constant changes in the power demand of consumers), then the system might already be intrinsically better suited to detect attacks via passive monitoring.