Data attacks on state estimation modify part of system measurements such that
the tempered measurements cause incorrect system state estimates. Attack
techniques proposed in the literature often require detailed knowledge of
system parameters. Such information is difficult to acquire in practice. The
subspace methods presented in this paper, on the other hand, learn the system
operating subspace from measurements and launch attacks accordingly. Conditions
for the existence of an unobservable subspace attack are obtained under the
full and partial measurement models. Using the estimated system subspace, two
attack strategies are presented. The first strategy aims to affect the system
state directly by hiding the attack vector in the system subspace. The second
strategy misleads the bad data detection mechanism so that data not under
attack are removed. Performance of these attacks are evaluated using the IEEE
14-bus network and the IEEE 118-bus network.Comment: 12 page