Cyber-Induced Risk Modeling for Microprocessor-Based Relays in Substations

Abstract

Once critical substations are compromised, attack agents can coordinate among their peers to plot for maximizing disruption using local control devices. For defenders, it is critical to enumerate and identify all digital relays to determine the systemic risks. Any combination of disruptive switching via the compromised relays can result in misoperation or immediate effect to the system. The resulting consequence of these attack's initial events would possibly incur cascading failure to a grid. This paper quantifies the criticality of substation protective relays with the combination of the outage level and its corresponding severity risk index. The proposed hypothesized outages are based on the type of protective relaying, bus configuration of a substation, and commonly implemented relaying schemes, such as bus differential, directional overcurrent and distance relays, are studied. This preliminary work also provides three approaches of determination in probabilities for sensitivity analysis. The proposed risk indices are evaluated using IEEE test systems.

Cascading verification initiated by switching attacks through compromised digital relays

“…However, the impact of those compromised SCADA and IEDs is not discussed. Reference [23] proposes a risk index and attempts to quantify which IED would give a more significant impact, refining the relevant work [19][20][21][22]. Despite the best efforts using the steady-state approach, the measure to identify worse-case combinations should be verified with dynamic simulation, including cascaded events.…”

Anomaly Inference Based on Heterogeneous Data Sources in an Electrical Distribution System

“…Malware usually runs in a system through the concealed installation and embedded in the data payloads of legitimate metering data. When the invasion of a single meter is completed, the worm or virus quickly infects nearby meters and can even invade the main server and host [180,181,182], causing massive tampering. The infected devices with malware can be manipulated to perform unauthorized use of services covertly [183].…”