Sequential cyber-attack detection in the large-scale smart grid system

Li, Shang; Yılmaz, Yasin; Wang, Xiaodong

doi:10.1109/smartgridcomm.2015.7436288

Cited by 6 publications

(9 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We assume that observations { X n ; n = 1, 2, ...} are independent and identically distributed with prechange

N (0, σ^{2})

and postchange

N (θ, σ^{2})

distributions, respectively, so that

L (X_{n}) = \exp \{\frac{θ}{σ^{2}} X_{n} - \frac{θ^{2}}{2 σ^{2}}\}

and F ∞ in Equation 4 is the LogNormal CDF with parameters

(- \frac{θ^{2}}{2 σ^{2}}, \frac{θ^{2}}{σ^{2}})

. Notice that the Gaussian assumption is rather standard model for plants and CPS. This is not only due to its mathematical tractability, but is also motivated by the fact that the processes under surveillance are often physical variables subject to measurement noise (for which the Gaussian is the leading model) or are anyway the result of several independent contributions so again the central limit theorem suggests, in absence of more reliable models or contradicting evidence, the Gaussian assumption.…”

Section: Simulation Resultsmentioning

confidence: 99%

“…The CUSUM has been largely used for monitoring and quickly detecting changes in industrial plants, and more recently for securing CPS. In the latter case, examples of monitored variables are power flows in smart grids, or pressure in water treatment plants . Such signals can be deceived by different types of attacks, thus affecting in turn the correct functioning of the system .…”

Section: Quickest Change‐detection Approachesmentioning

confidence: 99%

“…Indeed, because many design assumptions are no longer valid when perturbations to the system are caused by an adversarial attacker rather than random or structured failures, DDoS attacks toward CPS are a rising threat . Several CUSUM‐based algorithms have been proposed for detecting attacks toward CPS, in particular supervisory control and data acquisition (SCADA) systems, power system lines, and smart grids , …”

Section: Introductionmentioning

confidence: 99%

“…12 Several CUSUM-based algorithms have been proposed for detecting attacks toward CPS, [13][14][15] in particular supervisory control and data acquisition (SCADA) systems, 16 power system lines, 17 and smart grids. 18,19 In this letter, we capitalize on recent results appeared in the statistics literature, [20][21][22] which we believe pave the way for more effective algorithms in the application contexts described earlier. In particular, we show that the reaction time to an attack occurring at some instant during the surveillance period-the latter defined as the time window for which the statistical phenomenon under analysis is observed-can be controlled by considering different versions of the Shiryaev-Roberts (SR) quickest detection procedure, 23 and that flat response with respect to the change time can be achieved by a randomized variant known as Shiryaev-Roberts-Pollak (SRP).…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

An alternative procedure to cumulative sum for cyber‐physical attack detection

Coluccia

Fascista

2017

Internet Technology Letters

View full text Add to dashboard Cite

Motivated by the importance of change detection in cyber‐physical systems security, an alternative procedure to the classical cumulative sum (CUSUM) algorithm is explored. By capitalizing on recent results appeared in the statistical literature, it is shown that superior performance can be obtained in terms of reaction time while being robust against parameter mismatches. In order to translate such quickest‐detection‐theoretic advances into practical system‐engineering tools, a simple pseudocode is provided that ensures approximately flat response with respect to the change time. We believe the latter is a very important property that is missing in CUSUM‐based detection approaches.

show abstract

“…We assume that observations { X n ; n = 1, 2, ...} are independent and identically distributed with prechange

N (0, σ^{2})

and postchange

N (θ, σ^{2})

distributions, respectively, so that

L (X_{n}) = \exp \{\frac{θ}{σ^{2}} X_{n} - \frac{θ^{2}}{2 σ^{2}}\}

and F ∞ in Equation 4 is the LogNormal CDF with parameters

(- \frac{θ^{2}}{2 σ^{2}}, \frac{θ^{2}}{σ^{2}})

Section: Simulation Resultsmentioning

confidence: 99%

Section: Quickest Change‐detection Approachesmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

An alternative procedure to cumulative sum for cyber‐physical attack detection

Coluccia

Fascista

2017

Internet Technology Letters

View full text Add to dashboard Cite

show abstract

“…One area in particular that can take advantage of machine learning is cyber-physical security of the SG. Besides all of the benefits that come with the transition to the SG, the increasing reliance on communication, automation and information technology systems adds vulnerability to cyber-security threats [1][2][3][4][5][6][7]. Cyber-attacks have already been successfully executed with major consequences.…”

Section: Introductionmentioning

confidence: 99%

A Network Parameter Database False Data Injection Correction Physics-Based Model: A Machine Learning Synthetic Measurement-Based Approach

et al. 2021

View full text Add to dashboard Cite

Concerning power systems, real-time monitoring of cyber–physical security, false data injection attacks on wide-area measurements are of major concern. However, the database of the network parameters is just as crucial to the state estimation process. Maintaining the accuracy of the system model is the other part of the equation, since almost all applications in power systems heavily depend on the state estimator outputs. While much effort has been given to measurements of false data injection attacks, seldom reported work is found on the broad theme of false data injection on the database of network parameters. State-of-the-art physics-based model solutions correct false data injection on network parameter database considering only available wide-area measurements. In addition, deterministic models are used for correction. In this paper, an overdetermined physics-based parameter false data injection correction model is presented. The overdetermined model uses a parameter database correction Jacobian matrix and a Taylor series expansion approximation. The method further applies the concept of synthetic measurements, which refers to measurements that do not exist in the real-life system. A machine learning linear regression-based model for measurement prediction is integrated in the framework through deriving weights for synthetic measurements creation. Validation of the presented model is performed on the IEEE 118-bus system. Numerical results show that the approximation error is lower than the state-of-the-art, while providing robustness to the correction process. Easy-to-implement model on the classical weighted-least-squares solution, highlights real-life implementation potential aspects.

show abstract