Detecting data integrity attacks on SCADA systems using limited PMUs

Pal, Seemita; Sikdar, Biplab; Chow, Joe H.

doi:10.1109/smartgridcomm.2016.7778818

Cited by 12 publications

(7 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It has been known that Kalman filter exists in F i − HQ * i|i−1 for equation (19), with LQG controller, and Kalman filter is Gaussian independent identically distributed [22]. Suppose…”

Section: Q 2 Detector Kalman Filtersmentioning

confidence: 99%

An Overview of Recent Advances of Resilient Consensus for Multiagent Systems under Attacks

Aslam

Ahmed

et al. 2022

Computational Intelligence and Neuroscience

View full text Add to dashboard Cite

Consensus control of multiagent systems (MASs) has been one of the most extensive research topics in the field of robotics and automation. The information sharing among the agents in the MASs depends upon the communication network because the interaction of agents may affect the consensus performance of the agents in a communication network. An unexpected fault and attack may occur on one agent and can propagate through the communication network into other agents. Thus, this may cause severe degradation of the whole MASs. In this paper, we first discussed MAS technologies. After that available technologies for the modeling of attacks and fundamental issues due to attacks on MAS attacks were discussed. We also introduced cooperative attack methodologies and model-based attack methodology. Objective of this article is to provide comprehensive study on recent advances in consensus control of MASs under attacks covering the published results until 2021. This survey presents different kinds of attacks, their estimation and detection, and resilient control against attacks. At the end, the survey accomplishes some potential recommendations for future direction to solve the key issues and challenges reported for secure consensus control of MASs.

show abstract

“…It has been known that Kalman filter exists in F i − HQ * i|i−1 for equation (19), with LQG controller, and Kalman filter is Gaussian independent identically distributed [22]. Suppose…”

Section: Q 2 Detector Kalman Filtersmentioning

confidence: 99%

An Overview of Recent Advances of Resilient Consensus for Multiagent Systems under Attacks

Aslam

Ahmed

et al. 2022

Computational Intelligence and Neuroscience

View full text Add to dashboard Cite

show abstract

“…Chaojun et al [18] use KL divergence to calculate the distance between normal and false data to identify the latter directly. Pal et al [19] measure the Euclidean distance between real and tampered data to detect the data manipulation attacks directly. In both studies, the authors use divergence metrics to measure the dissimilarity between two data distributions and generate alerts for anomalies directly.…”

Section: Related Workmentioning

confidence: 99%

Divergence-Based Transferability Analysis for Self-Adaptive Smart Grid Intrusion Detection With Transfer Learning

et al. 2022

View full text Add to dashboard Cite

Machine learning is a popular approach to security monitoring and intrusion detection in cyber-physical systems (CPS) like the smart grid. However, these highly dynamic CPS operating in open environments can result in significant data distribution divergence, which may require the adaptation of a learned model. While transfer learning has been an effective approach to retain the performance against the divergence, there is still limited work on a more fundamental question that can be called transferability: when should one apply transfer learning? To address this challenge, this paper proposes a divergence-based transferability analysis to decide whether to apply transfer learning and autonomically adapt learning-based intrusion detectors. This work first identifies three metrics used to measure the divergence between data distributions, and then explores the relation between detector's accuracy drop and divergence in extensive temporal, spatial, and spatiotemporal experiments. Two regression models are trained to approximate the divergence-accuracy relation and then used to predict an accuracy drop which determines whether to apply transfer learning. Finally, a state-of-the-art domain adversarial neural network (DANN) classifier is adopted as the transfer learning model. Datasets from real normal operation profiles and simulated attacks are used to validate the effectiveness of the proposed transferability analysis against variations in attack timing, locations, and both. In all three scenarios, the proposed analysis demonstrated high accuracy in predicting accuracy drop from the divergence, with an RMSE lower than 4.20%, and the DANN can be timely triggered to achieve an accuracy improvement over 5.00%.

show abstract

“…Several methods have been introduced to detect FDIAs. For example, in [19] [20], an attack is detected by detecting the mismatch between the values obtained from PMUs and those obtained from SCADA. However, most events in power distribution systems that are of interest in the context of micro-PMU measurements, last only a few milliseconds to a few seconds.…”

Section: Related Literaturementioning

confidence: 99%

“…Note that, the superscripts in ( 18) and ( 19) denote the micro-PMU from which we started the successive calculation of the differential voltages across the power distribution feeder. Another note is that, both the forward sweep that results in (18) and the backward sweep that results in (19) need some knowledge about the loading at each bus. Such knowledge can be obtained by using the measurements from smart meters; in case smart meters are available.…”

Section: A Attack Detectionmentioning

confidence: 99%

Cyberattacks Against Event-Based Analysis in Micro-PMUs: Attack Models and Counter Measures

Kamal

Farajollahi

Nazaripouya

et al. 2021

IEEE Trans. Smart Grid

View full text Add to dashboard Cite

The recent advent of distribution-level phasor measurement units (D-PMUs), a.k.a., micro-PMUs, has introduced a wide range of new applications in power distribution systems. A sub-class of such emerging applications are called event-based methods. These methods focus on the analysis of events in the stream of micro-PMU measurements to achieve situational awareness, enhance load modeling, integrate distributed energy resources, etc. In this paper, we explore a scenario, where a cyberattack compromises the micro-PMU measurements during an event. Such a targeted attack could be limited in scope but result in a major impact on the operation of the power grid by highly deviating the outcome of the event-based methods. First, we investigate and model two types of such attacks, eventunsynchronized (basic) attacks and event-synchronized (advanced) attacks. We then conduct a geometric analysis to understand each attack type, in a setting where the events are represented in the phasor domain in a differential mode. Next, we introduce a novel method to detect the presence of the attack and then identify which micro-PMUs are compromised so as to discard the compromised measurements as a defense mechanism. The proposed approach makes critical use of magnitude as well as phase angle measurements from micro-PMUs. The method is tested on the IEEE 33-bus power distribution test system.

show abstract

Detecting data integrity attacks on SCADA systems using limited PMUs

Cited by 12 publications

References 9 publications

An Overview of Recent Advances of Resilient Consensus for Multiagent Systems under Attacks

An Overview of Recent Advances of Resilient Consensus for Multiagent Systems under Attacks

Divergence-Based Transferability Analysis for Self-Adaptive Smart Grid Intrusion Detection With Transfer Learning

Cyberattacks Against Event-Based Analysis in Micro-PMUs: Attack Models and Counter Measures

Contact Info

Product

Resources

About