Set-theoretic detection of data corruption attacks on cyber physical power systems

Abstract

This paper addresses a set-theoretic method for the detection of data corruption cyber-attacks on the load frequency control loop of a networked power system. The system consists of several interconnected control areas forming a power grid. Based on the overall discrete-time network dynamics, a convex and compact polyhedral robust invariant set is extracted and is used as a set-induced anomaly detector. If the state vector exits the invariant set, then an alarm will be activated, and the potential threat is considered disclosed. The attack scenario used to assess the efficiency of the proposed anomaly detector concerns corrupted frequency sensor measurements transmitted to the automatic generation control unit of a compromised control area. Simulation studies highlight the ability of a set-theoretic approach to disclose persistent and intermittent attack patterns even when they occur at the same time with changes in the power load demand.

Hybrid Detection of Intermittent Cyber-Attacks in Networked Power Systems

“…The algorithms used for the calculation of the robust invariant sets, and thus for the design of the set-theoretic detectors, involve discrete-time systems [26,27]. In this work, we aim to develop an estimation-based detector and then combine it with a set-theoretic one.…”

“…In this work, we aim to develop an estimation-based detector and then combine it with a set-theoretic one. We adopt a common modeling basis for both detectors, by remaining consistent with the discrete-time approach introduced in [26,27]. However, our original framework requires certain modifications in order to yield an observable state space model of the power grid.…”

“…It is shown that the only way to quantify the discrepancies of the estimation residue is to exploit the safety constraints of the state variables and resort to set-theoretic methods. In addition, we prove that we are mathematically inclined to determine the robust invariant set based not on the dynamics of the estimator but based on the dynamics of the system itself, inevitably resorting to the detectors developed in [26,27].…”

“…These fluctuations are dangerous since they stress the tie line to its thermal limit and can cause the coupled generators to desynchronize. The primary objective is to establish a mathematical link between the classical estimation-based attack detectors [25] and their recently introduced set-theoretic counterparts, proposed in [26,27]. The idea is to combine the best traits of the two methods and develop a hybrid detector, which performs better than each detector alone in the case of intermittent attacks.…”

“…On the other hand, a set-theoretic attack detector relies on the extraction of suitable robust invariant sets, which stem from safety considerations and are used as sets of alarm constraints [26,27]. A set is said to be robust invariant with respect to the dynamics of a system, when the state trajectories emanating from every initial condition that belongs to this set remain within the same set for every future time instant and for every admissible disturbance sequence [28].…”