False Data Injection Attacks on Phasor Measurements That Bypass Low-rank Decomposition

This paper studies the vulnerability of phasor measurement units (PMUs) to false data injection (FDI) attacks. Prior work demonstrated that unobservable FDI attacks that can bypass traditional bad data detectors based on measurement residuals can be identified by detector based on low-rank decomposition (LD). In this work, a class of more sophisticated FDI attacks that captures the temporal correlation of PMU data is introduced. Such attacks are designed with a convex optimization problem and can always bypass the LD detector. The vulnerability of this attack model is illustrated on both the IEEE 24-bus RTS and the IEEE 118-bus systems.Comment: 6 pages, 4 figures, submitted to 2017 IEEE International Conference on Smart Grid Communications (SmartGridComm

PMU Placement in Electric Transmission Networks for Reliable State Estimation against False Data Injection Attacks

Currently the false data injection (FDI) attack bring direct challenges in synchronized phase measurement unit (PMU) based network state estimation in wide-area measurement system (WAMS), resulting in degraded system reliability and power supply security. This paper assesses the performance of state estimation in electric cyber-physical system (ECPS) paradigm considering the presence of FDI attacks. The adverse impact on network state estimation is evaluated through simulations for a range of FDI attack scenarios using IEEE 14-bus network model. In addition, an algorithmic solution is proposed to address the issue of additional PMU installation and placement with cyber security consideration and evaluated for a set of standard electric transmission networks (IEEE 14-bus, 30-bus and 57-bus network). The numerical result confirms that the FDI attack can significantly degrade the state estimation and the cyber security can be improved by an appropriate placement of a limited number of additional PMUs

Vulnerability Analysis of False Data Injection Attacks on Supervisory Control and Data Acquisition and Phasor Measurement Units

abstract: The electric power system is monitored via an extensive network of sensors in tandem with data processing algorithms, i.e., an intelligent cyber layer, that enables continual observation and control of the physical system to ensure reliable operations. This data collection and processing system is vulnerable to cyber-attacks that impact the system operation status and lead to serious physical consequences, including systematic problems and failures. This dissertation studies the physical consequences of unobservable false data injection (FDI) attacks wherein the attacker maliciously changes supervisory control and data acquisition (SCADA) or phasor measurement unit (PMU) measurements, on the electric power system. In this context, the dissertation is divided into three parts, in which the first two parts focus on FDI attacks on SCADA and the last part focuses on FDI attacks on PMUs. The first part studies the physical consequences of FDI attacks on SCADA measurements designed with limited system information. The attacker is assumed to have perfect knowledge inside a sub-network of the entire system. Two classes of attacks with different assumptions on the attacker's knowledge outside of the sub-network are introduced. In particular, for the second class of attacks, the attacker is assumed to have no information outside of the attack sub-network, but can perform multiple linear regression to learn the relationship between the external network and the attack sub-network with historical data. To determine the worst possible consequences of both classes of attacks, a bi-level optimization problem wherein the first level models the attacker's goal and the second level models the system response is introduced. The second part of the dissertation concentrates on analyzing the vulnerability of systems to FDI attacks from the perspective of the system. To this end, an off-line vulnerability analysis framework is proposed to identify the subsets of the test system that are more prone to FDI attacks. The third part studies the vulnerability of PMUs to FDI attacks. Two classes of more sophisticated FDI attacks that capture the temporal correlation of PMU data are introduced. Such attacks are designed with a convex optimization problem and can always bypass both the bad data detector and the low-rank decomposition (LD) detector.Dissertation/ThesisDoctoral Dissertation Electrical Engineering 201

A power system and synchrophasor communication network co-simulation testbed with a real-time cyber security application

The development of smart grids facilitates the deployment of phasor measurement units (PMUs) to improve the system stability and reliability. The growing installation of PMUs provides grid operators wide-area situational awareness while introducing additional vulnerabilities to power systems from the cyber security point of view. Thus, not only the online method to handle such vulnerabilities real-time but also the corresponding power system simulation environments with appropriate time-fidelity are needed. This thesis presents two major works: an interactive, extensible environment for power system simulation and a real-time malicious PMU data detection method. The first part introduces such an environment that operates with power system models in the PMU time frame, including data visualization and interactive control action capabilities. The flexible and extensible capabilities are demonstrated by interfacing with a synchrophasor communication network simulation, which is a testbed for developing real-time PMU data related applications. The second part proposes an online method to detect ongoing contingencies in the system and malicious data attack on its underlying synchrophasor communication network. To do so, the principal component analysis is applied to leverage the spatial and temporal correlations among the PMU data, and the method is implemented in the synchrophasor network simulation for data collection and tests. Pattern match and data reconstruction are proposed to identify incident types and find their most possible locations. The thesis illustrates the extensibility of the interactive simulation environment and the effectiveness of the proposed method with a 150 buses case

Machine Learning Based Detection of False Data Injection Attacks in Wide Area Monitoring Systems

The Smart Grid (SG) is an upgraded, intelligent, and a more reliable version of the traditional Power Grid due to the integration of information and communication technologies. The operation of the SG requires a dense communication network to link all its components. But such a network renders it prone to cyber attacks jeopardizing the integrity and security of the communicated data between the physical electric grid and the control centers. One of the most prominent components of the SG are Wide Area Monitoring Systems (WAMS). WAMS are a modern platform for grid-wide information, communication, and coordination that play a major role in maintaining the stability of the grid against major disturbances. In this thesis, an anomaly detection framework is proposed to identify False Data Injection (FDI) attacks in WAMS using different Machine Learning (ML) and Deep Learning (DL) techniques, i.e., Deep Autoencoders (DAE), Long-Short Term Memory (LSTM), and One-Class Support Vector Machine (OC-SVM). These algorithms leverage diverse, complex, and high-volume power measurements coming from communications between different components of the grid to detect intelligent FDI attacks. The injected false data is assumed to target several major WAMS monitoring applications, such as Voltage Stability Monitoring (VSM), and Phase Angle Monitoring (PAM). The attack vector is considered to be smartly crafted based on the power system data, so that it can pass the conventional bad data detection schemes and remain stealthy. Due to the lack of realistic attack data, machine learning-based anomaly detection techniques are used to detect FDI attacks. To demonstrate the impact of attacks on the realistic WAMS traffic and to show the effectiveness of the proposed detection framework, a Hardware-In-the-Loop (HIL) co-simulation testbed is developed. The performance of the implemented techniques is compared on the testbed data using different metrics: Accuracy, F1 score, and False Positive Rate (FPR) and False Negative Rate (FNR). The IEEE 9-bus and IEEE 39-bus systems are used as benchmarks to investigate the framework scalability. The experimental results prove the effectiveness of the proposed models in detecting FDI attacks in WAMS

Real-Time Machine Learning Models To Detect Cyber And Physical Anomalies In Power Systems

A Smart Grid is a cyber-physical system (CPS) that tightly integrates computation and networking with physical processes to provide reliable two-way communication between electricity companies and customers. However, the grid availability and integrity are constantly threatened by both physical faults and cyber-attacks which may have a detrimental socio-economic impact. The frequency of the faults and attacks is increasing every year due to the extreme weather events and strong reliance on the open internet architecture that is vulnerable to cyber-attacks. In May 2021, for instance, Colonial Pipeline, one of the largest pipeline operators in the U.S., transports refined gasoline and jet fuel from Texas up the East Coast to New York was forced to shut down after being attacked by ransomware, causing prices to rise at gasoline pumps across the country. Enhancing situational awareness within the grid can alleviate these risks and avoid their adverse consequences. As part of this process, the phasor measurement units (PMU) are among the suitable assets since they collect time-synchronized measurements of grid status (30-120 samples/s), enabling the operators to react rapidly to potential anomalies. However, it is still challenging to process and analyze the open-ended source of PMU data as there are more than 2500 PMU distributed across the U.S. and Canada, where each of which generates more than 1.5 TB/month of streamed data. Further, the offline machine learning algorithms cannot be used in this scenario, as they require loading and scanning the entire dataset before processing. The ultimate objective of this dissertation is to develop early detection of cyber and physical anomalies in a real-time streaming environment setting by mining multi-variate large-scale synchrophasor data. To accomplish this objective, we start by investigating the cyber and physical anomalies, analyzing their impact, and critically reviewing the current detection approaches. Then, multiple machine learning models were designed to identify physical and cyber anomalies; the first one is an artificial neural network-based approach for detecting the False Data Injection (FDI) attack. This attack was specifically selected as it poses a serious risk to the integrity and availability of the grid; Secondly, we extend this approach by developing a Random Forest Regressor-based model which not only detects anomalies, but also identifies their location and duration; Lastly, we develop a real-time hoeffding tree-based model for detecting anomalies in steaming networks, and explicitly handling concept drifts. These models have been tested and the experimental results confirmed their superiority over the state-of-the-art models in terms of detection accuracy, false-positive rate, and processing time, making them potential candidates for strengthening the grid\u27s security

On Statistical QoS Provisioning for Smart Grid

Current power system is in the transition from traditional power grid to Smart Grid. A key advantage of Smart Grid is its integration of advanced communication technologies, which can provide real-time system-wide two-way information links. Since the communication system and power system are deeply coupled within the Smart Grid system, it makes Quality of Service (QoS) performance analysis much more complex than that in either system alone. In order to address this challenge, the effective rate theory is studied and extended in this thesis, where a new H transform based framework is proposed. Various scenarios are investigated using the new proposed effective rate framework, including both independent and correlated fading channels. With the effective rate as a connection between the communication system and the power system, an analysis of the power grid observability under communication constraints is performed. Case studies show that the effective rate provides a cross layer analytical framework within the communication system, while its statistical characterisation of the communication delay has the potential to be applied as a general coupling point between the communication system and the power system, especially when real-time applications are considered. Besides the theoretical QoS performance analysis within Smart Grid, a new Software Defined Smart Grid testbed is proposed in this thesis. This testbed provides a versatile evaluation and development environment for Smart Grid QoS performance studies. It exploits the Real Time Digital Simulator (RTDS) to emulate different power grid configurations and the Software Defined Radio (SDR) environment to implement the communication system. A data acquisition and actuator module is developed, which provides an emulation of various Intelligent Electronic Devices (IEDs). The implemented prototype demonstrates that the proposed testbed has the potential to evaluate real time Smart Grid applications such as real time voltage stability control