arXiv subjects

Katherine Davis

Publications and source records attributed to Katherine Davis.

At least 19 recordsLinked to original sources

arXiv2024

A Reinforcement Learning Engine with Reduced Action and State Space for Scalable Cyber-Physical Optimal Response

Numerous research studies have been conducted to enhance the resilience of cyber-physical systems (CPSs) by detecting potential cyber or physical disturbances. However, the development of scalable and optimal response measures under power system contingency based on fusing cyber-physical data is still in an early stage. To address this research gap, this paper introduces a power system response engine based on reinforcement learning (RL) and role and interaction discovery (RID) techniques. RL-RID-GridResponder is designed to automatically detect the contingency and assist with the decision-making process to ensure optimal power system operation. The RL-RID-GridResponder learns via an RL-based structure and achieves enhanced scalability by integrating an RID module with reduced action and state spaces. The applicability of RL-RID-GridResponder in providing scalable and optimal responses for CPSs is demonstrated on power systems in the context of Denial of Service (DoS) attacks. Moreover, simulations are conducted on a Volt-Var regulation problem using the augmented WSCC 9-bus and augmented IEEE 24-bus systems based on fused cyber and physical data sets. The results show that the proposed RL-RID-GridResponder can provide fast and accurate responses to ensure optimal power system operation under DoS and can extend to other system contingencies such as line outages and loss of loads.

eess.SY↗

arXiv2024

On Graph Theory vs. Time-Domain Discrete Event Simulation for Topology-Informed Assessment of Power Grid Cyber Risk

The shift toward more renewable energy sources and distributed generation in smart grids has underscored the significance of modeling and analyzing modern power systems as cyber-physical systems (CPS). This transformation has highlighted the importance of cyber and cyber-physical properties of modern power systems for their reliable operation. Graph theory emerges as a pivotal tool for understanding the complex interactions within these systems, providing a framework for representation and analysis. The challenge is vetting these graph theoretic methods and other estimates of system behavior from mathematical models against reality. High-fidelity emulation and/or simulation can help answer this question, but the comparisons have been understudied. This paper employs graph-theoretic metrics to assess node risk and criticality in three distinct case studies, using a Python-based discrete-event simulation called SimPy. Results for each case study show that combining graph theory and simulation provides a topology-informed security assessment. These tools allow us to identify critical network nodes and evaluate their performance and reliability under a cyber threat such as denial of service threats.

math.NA↗

arXiv2024

CyberDep: Towards the Analysis of Cyber-Physical Power System Interdependencies Using Bayesian Networks and Temporal Data

Modern-day power systems have become increasingly cyber-physical due to the ongoing developments to the grid that include the rise of distributed energy generation and the increase of the deployment of many cyber devices for monitoring and control, such as the Supervisory Control and Data Acquisition (SCADA) system. Such capabilities have made the power system more vulnerable to cyber-attacks that can harm the physical components of the system. As such, it is of utmost importance to study both the physical and cyber components together, focusing on characterizing and quantifying the interdependency between these components. This paper focuses on developing an algorithm, named CyberDep, for Bayesian network generation through conditional probability calculations of cyber traffic flows between system nodes. Additionally, CyberDep is implemented on the temporal data of the cyber-physical emulation of the WSCC 9-bus power system. The results of this work provide a visual representation of the probabilistic relationships within the cyber and physical components of the system, aiding in cyber-physical interdependency quantification.

eess.SY↗

arXiv2023

A Firewall Optimization for Threat-Resilient Micro-Segmentation in Power System Networks

Electric power delivery relies on a communications backbone that must be secure. SCADA systems are essential to critical grid functions and include industrial control systems (ICS) protocols such as the Distributed Network Protocol-3 (DNP3). These protocols are vulnerable to cyber threats that power systems, as cyber-physical critical infrastructure, must be protected against. For this reason, the NERC Critical Infrastructure Protection standard CIP-005-5 specifies that an electronic system perimeter is needed, accomplished with firewalls. This paper presents how these electronic system perimeters can be optimally found and generated using a proposed meta-heuristic approach for optimal security zone formation for large-scale power systems. Then, to implement the optimal firewall rules in a large scale power system model, this work presents a prototype software tool that takes the optimization results and auto-configures the firewall nodes for different utilities in a cyber-physical testbed. Using this tool, firewall policies are configured for all the utilities and their substations within a synthetic 2000-bus model, assuming two different network topologies. Results generate the optimal electronic security perimeters to protect a power system's data flows and compare the number of firewalls, monetary cost, and risk alerts from path analysis.

eess.SY↗

arXiv2023

Bayesian Reinforcement Learning for Automatic Voltage Control under Cyber-Induced Uncertainty

Voltage control is crucial to large-scale power system reliable operation, as timely reactive power support can help prevent widespread outages. However, there is currently no built in mechanism for power systems to ensure that the voltage control objective to maintain reliable operation will survive or sustain the uncertainty caused under adversary presence. Hence, this work introduces a Bayesian Reinforcement Learning (BRL) approach for power system control problems, with focus on sustained voltage control under uncertainty in a cyber-adversarial environment. This work proposes a data-driven BRL-based approach for automatic voltage control by formulating and solving a Partially-Observable Markov Decision Problem (POMDP), where the states are partially observable due to cyber intrusions. The techniques are evaluated on the WSCC and IEEE 14 bus systems. Additionally, BRL techniques assist in automatically finding a threshold for exploration and exploitation in various RL techniques.

cs.LG↗

arXiv2022

Toward a Mathematical Vulnerability Propagation and Defense Model in Smart Grid Networks

For reducing threat propagation within an inter-connected network, it is essential to distribute the defense investment optimally. Most electric power utilities are resource constrained, yet how to account for costs while designing threat reduction techniques is not well understood. Hence, in this work, a vulnerability propagation and a defense model is proposed based on an epidemic model. The new defense mechanism is then validated through sensitivity of the propagation parameters on the optimal investment with two-node and N-node cases. Further, the model efficacy is evaluated with implementation in one of the communication networks of a cyber-physical power system. Topological impact on the optimal nodal investment is also emphasized. Optimal investment of the neighbors with less degree were found to be highly sensitive to fluctuation in vulnerability exploitability probability.

cs.CR↗

arXiv2022

Infinite Impulse Response Graph Neural Networks for Cyberattack Localization in Smart Grids

This study employs Infinite Impulse Response (IIR) Graph Neural Networks (GNN) to efficiently model the inherent graph network structure of the smart grid data to address the cyberattack localization problem. First, we numerically analyze the empirical frequency response of the Finite Impulse Response (FIR) and IIR graph filters (GFs) to approximate an ideal spectral response. We show that, for the same filter order, IIR GFs provide a better approximation to the desired spectral response and they also present the same level of approximation to a lower order GF due to their rational type filter response. Second, we propose an IIR GNN model to efficiently predict the presence of cyberattacks at the bus level. Finally, we evaluate the model under various cyberattacks at both sample-wise (SW) and bus-wise (BW) level, and compare the results with the existing architectures. It is experimentally verified that the proposed model outperforms the state-of-the-art FIR GNN model by 9.2% and 14% in terms of SW and BW localization, respectively.

eess.SP↗

arXiv2022

Spatio-Temporal Failure Propagation in Cyber-Physical Power Systems

Cascading failure in power systems is triggered by a small perturbation that leads to a sequence of failures spread through the system. The interconnection between different components in a power system causes failures to easily propagate across the system. The situation gets worse by considering the interconnection between cyber and physical layers in power systems. A plethora of work has studied the cascading failure in power systems to calculate its impact on the system. Understanding how failures propagate into the system in time and space can help the system operator to take preventive actions and upgrade the system accordingly. Due to the nonlinearity of the power flow equation as well as the engineering constraints in the power system, it is essential to understand the spatio-temporal failure propagation in cyber-physical power systems (CPPS). This paper proposes an asynchronous algorithm for investigating failure propagation in CPPS. The physics of the power system is addressed by the full AC power flow equations. Various practical constraints including load shedding, load-generation balance, and island operation are considered to address practical constraints in power system operation. The propagation of various random initial attacks of different sizes is analyzed and visualized to elaborate on the applicability of the proposed approach. Our findings shed light on the cascading failure evolution in CPPS.

eess.SY↗

arXiv2022

Generating Connected, Simple, and Realistic Cyber Graphs for Smart Grids

Smart grids integrate communication systems with power networks to enable power grids operation and command through real-time data collection and control signals. Designing, analyzing, and simulating smart grid infrastructures as well as predicting the impact of power network failures strongly depend on the topologies of the underlying power network and communication system. Despite the substantial impact that the communication systems bring to smart grid operation, the topology of communication systems employed in smart grids was less studied. The power community lacks realistic generative communication system models that can be calibrated to match real-world data. To address this issue, this paper proposes a framework to generate the underlying topological graphs for the communication systems deployed in smart grids by mimicking the topology of real-world smart grids. In this regard, we have updated the Chung-Lu algorithm to guarantee the communication network connectivity and to match the degree distribution of a real-world smart grid rather than following an expected degree distribution. In addition, key characteristics of communication systems such as diameter, average shortest paths, clustering coefficients, assortativity, and spectral gap were taken into consideration to generate the most similar real-world communication network for smart grid studies. We believe that the proposed algorithm to generate realistic cyber graphs for smart grid studies will benefit the power community.

cs.SI↗

arXiv2021

Cyberattack Detection in Large-Scale Smart Grids using Chebyshev Graph Convolutional Networks

As a highly complex and integrated cyber-physical system, modern power grids are exposed to cyberattacks. False data injection attacks (FDIAs), specifically, represent a major class of cyber threats to smart grids by targeting the measurement data's integrity. Although various solutions have been proposed to detect those cyberattacks, the vast majority of the works have ignored the inherent graph structure of the power grid measurements and validated their detectors only for small test systems with less than a few hundred buses. To better exploit the spatial correlations of smart grid measurements, this paper proposes a deep learning model for cyberattack detection in large-scale AC power grids using Chebyshev Graph Convolutional Networks (CGCN). By reducing the complexity of spectral graph filters and making them localized, CGCN provides a fast and efficient convolution operation to model the graph structural smart grid data. We numerically verify that the proposed CGCN based detector surpasses the state-of-the-art model by 7.86 in detection rate and 9.67 in false alarm rate for a large-scale power grid with 2848 buses. It is notable that the proposed approach detects cyberattacks under 4 milliseconds for a 2848-bus system, which makes it a good candidate for real-time detection of cyberattacks in large systems.

cs.CR↗

arXiv2021

Inter-Domain Fusion for Enhanced Intrusion Detection in Power Systems: An Evidence Theoretic and Meta-Heuristic Approach

False alerts due to misconfigured/ compromised IDS in ICS networks can lead to severe economic and operational damage. To solve this problem, research has focused on leveraging deep learning techniques that help reduce false alerts. However, a shortcoming is that these works often require or implicitly assume the physical and cyber sensors to be trustworthy. Implicit trust of data is a major problem with using artificial intelligence or machine learning for CPS security, because during critical attack detection time they are more at risk, with greater likelihood and impact, of also being compromised. To address this shortcoming, the problem is reframed on how to make good decisions given uncertainty. Then, the decision is detection, and the uncertainty includes whether the data used for ML-based IDS is compromised. Thus, this work presents an approach for reducing false alerts in CPS power systems by dealing uncertainty without the knowledge of prior distribution of alerts. Specifically, an evidence theoretic based approach leveraging Dempster Shafer combination rules are proposed for reducing false alerts. A multi-hypothesis mass function model is designed that leverages probability scores obtained from various supervised-learning classifiers. Using this model, a location-cum-domain based fusion framework is proposed and evaluated with different combination rules, that fuse multiple evidence from inter-domain and intra-domain sensors. The approach is demonstrated in a cyber-physical power system testbed with Man-In-The-Middle attack emulation in a large-scale synthetic electric grid. For evaluating the performance, plausibility, belief, pignistic, etc. metrics as decision functions are considered. To improve the performance, a multi-objective based genetic algorithm is proposed for feature selection considering the decision metrics as the fitness function.

cs.AI↗

arXiv2021

An Energy Management System Approach for Power System Cyber-Physical Resilience

Power systems are large scale cyber-physical critical infrastructure that form the basis of modern society. The reliability and resilience of the grid is dependent on the correct functioning of related subsystems, including computing, communications, and control. The integration is widespread and has a profound impact on the operation, reliability, and efficiency of the grid. Technologies comprising these infrastructure can expose new sources of threats. Mapping these threats to their grid resilience impacts to stop them early requires a timely and detailed view of the entire cyber-physical system. Grid resilience must therefore be seen and addressed as a cyber-physical systems problem. This short position paper presents several key preliminaries, supported with evidence from experience, to enable cyber-physical situational awareness and intrusion response through a cyber-physical energy management system.

eess.SY↗

arXiv2021

An Ecological Robustness-Oriented Approach for Power System Network Expansion

Power systems are critical infrastructure for reliable and secure electric energy delivery. Incidents are increasing, as unexpected multiple hazards ranging from natural disasters to cyberattacks threaten the security and functionality of society. Inspired by resilient ecosystems, this paper presents a resilient network design approach with an ecological robustness (R ECO )-oriented optimization to improve power systems' ability to maintain a secure operating state throughout unknown hazards. The approach uses R ECO , a surprisal -based metric that captures key features of an ecosystem's resilient structure, as an objective to strategically design the electrical network. The approach enables solvability and practicality by introducing a stochastic-based candidate branch creation algorithm and a Taylor series expansion for relaxation of the R ECO formulation. Finally, studies are conducted on the R ECO -oriented approach using the IEEE 24 Bus RTS and the ACTIVSg200 systems. Results demonstrate improvement of the system's reliability under multiple hazards, network properties of robust structure and equally distributed power flows, and survivability against cascading failures. From the analysis, we observe that a more redundant network structure with equally distributed power flows benefits its resilience.

eess.SY↗

arXiv2021

Joint Detection and Localization of Stealth False Data Injection Attacks in Smart Grids using Graph Neural Networks

False data injection attacks (FDIA) are a main category of cyber-attacks threatening the security of power systems. Contrary to the detection of these attacks, less attention has been paid to identifying the attacked units of the grid. To this end, this work jointly studies detecting and localizing the stealth FDIA in power grids. Exploiting the inherent graph topology of power systems as well as the spatial correlations of measurement data, this paper proposes an approach based on the graph neural network (GNN) to identify the presence and location of the FDIA. The proposed approach leverages the auto-regressive moving average (ARMA) type graph filters (GFs) which can better adapt to sharp changes in the spectral domain due to their rational type filter composition compared to the polynomial type GFs such as Chebyshev. To the best of our knowledge, this is the first work based on GNN that automatically detects and localizes FDIA in power systems. Extensive simulations and visualizations show that the proposed approach outperforms the available methods in both detection and localization of FDIA for different IEEE test systems. Thus, the targeted areas can be identified and preventive actions can be taken before the attack impacts the grid.

cs.LG↗

arXiv2021

Graph Neural Networks Based Detection of Stealth False Data Injection Attacks in Smart Grids

False data injection attacks (FDIAs) represent a major class of attacks that aim to break the integrity of measurements by injecting false data into the smart metering devices in power grids. To the best of authors' knowledge, no study has attempted to design a detector that automatically models the underlying graph topology and spatially correlated measurement data of the smart grids to better detect cyber attacks. The contributions of this paper to detect and mitigate FDIAs are twofold. First, we present a generic, localized, and stealth (unobservable) attack generation methodology and publicly accessible datasets for researchers to develop and test their algorithms. Second, we propose a Graph Neural Network (GNN) based, scalable and real-time detector of FDIAs that efficiently combines model-driven and data-driven approaches by incorporating the inherent physical connections of modern AC power grids and exploiting the spatial correlations of the measurement. It is experimentally verified by comparing the proposed GNN based detector with the currently available FDIA detectors in the literature that our algorithm outperforms the best available solutions by 3.14%, 4.25%, and 4.41% in F1 score for standard IEEE testbeds with 14, 118, and 300 buses, respectively.

eess.SP↗

arXiv2021

Statistics for Building Synthetic Power System Cyber Models

A realistic communication system model is critical in power system studies emphasizing the cyber and physical intercoupling. In this paper, we provide characteristics that could be used in modeling the underlying cyber network for power grid models. A real utility communication network and a simplified inter-substation connectivity model are studied, and their statistics could be used to fulfill the requirements for different modeling resolutions.

eess.SY↗

arXiv2021

Man-in-The-Middle Attacks and Defense in a Power System Cyber-Physical Testbed

Man-in-The-Middle (MiTM) attacks present numerous threats to a smart grid. In a MiTM attack, an intruder embeds itself within a conversation between two devices to either eavesdrop or impersonate one of the devices, making it appear to be a normal exchange of information. Thus, the intruder can perform false data injection (FDI) and false command injection (FCI) attacks that can compromise power system operations, such as state estimation, economic dispatch, and automatic generation control (AGC). Very few researchers have focused on MiTM methods that are difficult to detect within a smart grid. To address this, we are designing and implementing multi-stage MiTM intrusions in an emulation-based cyber-physical power system testbed against a large-scale synthetic grid model to demonstrate how such attacks can cause physical contingencies such as misguided operation and false measurements. MiTM intrusions create FCI, FDI, and replay attacks in this synthetic power grid. This work enables stakeholders to defend against these stealthy attacks, and we present detection mechanisms that are developed using multiple alerts from intrusion detection systems and network monitoring tools. Our contribution will enable other smart grid security researchers and industry to develop further detection mechanisms for inconspicuous MiTM attacks.

cs.CR↗

arXiv2021

Multi-Source Data Fusion for Cyberattack Detection in Power Systems

Cyberattacks can cause a severe impact on power systems unless detected early. However, accurate and timely detection in critical infrastructure systems presents challenges, e.g., due to zero-day vulnerability exploitations and the cyber-physical nature of the system coupled with the need for high reliability and resilience of the physical system. Conventional rule-based and anomaly-based intrusion detection system (IDS) tools are insufficient for detecting zero-day cyber intrusions in the industrial control system (ICS) networks. Hence, in this work, we show that fusing information from multiple data sources can help identify cyber-induced incidents and reduce false positives. Specifically, we present how to recognize and address the barriers that can prevent the accurate use of multiple data sources for fusion-based detection. We perform multi-source data fusion for training IDS in a cyber-physical power system testbed where we collect cyber and physical side data from multiple sensors emulating real-world data sources that would be found in a utility and synthesizes these into features for algorithms to detect intrusions. Results are presented using the proposed data fusion application to infer False Data and Command injection-based Man-in- The-Middle (MiTM) attacks. Post collection, the data fusion application uses time-synchronized merge and extracts features followed by pre-processing such as imputation and encoding before training supervised, semi-supervised, and unsupervised learning models to evaluate the performance of the IDS. A major finding is the improvement of detection accuracy by fusion of features from cyber, security, and physical domains. Additionally, we observed the co-training technique performs at par with supervised learning methods when fed with our features.

cs.LG↗