Cyber-attack detection and resilient state estimation in power systems

Abstract

Many critical infrastructures, such as transportation and electric energy networks, and health care, are now becoming highly integrated with information and communication technology, in order to be more efficient and reliable. These cyber-physical systems (CPS) now face an increasing threat of cyber-attacks. Intelligent attackers can leverage their knowledge of the system, disruption, and disclosure resources to critically damage the system while remaining undiscovered. In this dissertation, we develop a defense strategy, with the ability to uncover malicious and intelligent attacks and enable resilient operation of cyber-physical systems. Specifically, we apply this defense strategy to power systems, described by linear frequency dynamics around the nominal operating point. Our methodology is based on the notion of data aggregation as a tool for extracting internal information about the system that may be unknown to the attacker. As the first step to resilience and security, we propose several methods for active attack detection in cyber-physical systems. In one approach we design a clustering-based moving-target active detection algorithm and evaluate it against stealthy attacks on the 5-bus and 24-bus power grids. Next, we consider an approach based on Interaction Variables (IntVar), as another intuitive way to extract internal information in power grids. We evaluate the eectiveness of this approach on Automatic Generation Control (AGC), a vital control mechanism in today's power grid. After an attack has been detected, mitigation procedures must be put in place to allow continued reliable operation or graceful degradation of the power grid. To that end, we develop a resilient state estimation algorithm, that provides the system operator with situational awareness in the presence of wide-spread coordinated cyber-attacks when many system measurements may become unavailable.