arXiv subjects

Zhigang Chu

Publications and source records attributed to Zhigang Chu.

11 recordsLinked to original sources

arXiv2021

A Verifiable Framework for Cyber-Physical Attacks and Countermeasures in a Resilient Electric Power Grid

In this paper, we investigate the feasibility and physical consequences of cyber attacks against energy management systems (EMS). Within this framework, we have designed a complete simulation platform to emulate realistic EMS operations: it includes state estimation (SE), real-time contingency analysis (RTCA), and security constrained economic dispatch (SCED). This software platform allowed us to achieve two main objectives: 1) to study the cyber vulnerabilities of an EMS and understand their consequences on the system, and 2) to formulate and implement countermeasures against cyber-attacks exploiting these vulnerabilities. Our results show that the false data injection attacks against state estimation described in the literature do not easily cause base-case overflows because of the conservatism introduced by RTCA. For a successful attack, a more sophisticated model that includes all of the EMS blocks is needed; even in this scenario, only post-contingency violations can be achieved. Nonetheless, we propose several countermeasures that can detect changes due to cyber-attacks and limit their impact on the system.

eess.SY↗

arXiv2020

Detecting Load Redistribution Attacks via Support Vector Models

A machine learning-based detection framework is proposed to detect a class of cyber-attacks that redistribute loads by modifying measurements. The detection framework consists of a multi-output support vector regression (SVR) load predictor that predicts loads by exploiting both spatial and temporal correlations, and a subsequent support vector machine (SVM) attack detector to determine the existence of load redistribution (LR) attacks utilizing loads predicted by the SVR predictor. Historical load data for training the SVR are obtained from the publicly available PJM zonal loads and are mapped to the IEEE 30-bus system. The SVM is trained using normal data and randomly created LR attacks, and is tested against both random and intelligently designed LR attacks. The results show that the proposed detection framework can effectively detect LR attacks. Moreover, attack mitigation can be achieved by using the SVR predicted loads to re-dispatch generations.

eess.SY↗

arXiv2020

$N-1$ Reliability Makes It Difficult for False Data Injection Attacks to Cause Physical Consequences

This paper demonstrates that false data injection (FDI) attacks are extremely limited in their ability to cause physical consequences on $N-1$ reliable power systems operating with real-time contingency analysis (RTCA) and security constrained economic dispatch (SCED). Prior work has shown that FDI attacks can be designed via an attacker-defender bi-level linear program (ADBLP) to cause physical overflows after re-dispatch using DCOPF. In this paper, it is shown that attacks designed using DCOPF fail to cause overflows on $N-1$ reliable systems because the system response modeled is inaccurate. An ADBLP that accurately models the system response is proposed to find the worst-case physical consequences, thereby modeling a strong attacker with system level knowledge. Simulation results on the synthetic Texas system with 2000 buses show that even with the new enhanced attacks, for systems operated conservatively due to $N-1$ constraints, the designed attacks only lead to post-contingency overflows. Moreover, the attacker must control a large portion of measurements and physically create a contingency in the system to cause consequences. Therefore, it is conceivable but requires an extremely sophisticated attacker to cause physical consequences on $N-1$ reliable power systems operated with RTCA and SCED.

eess.SY↗

arXiv2019

A Nonlinear Regression Method for Composite Protection Modeling of Induction Motor Loads

Protection equipment is used to prevent damage to induction motor loads by isolating them from power systems in the event of severe faults. Modeling the response of induction motor loads and their protection is vital for power system planning and operation, especially in understanding system's dynamic performance and stability after a fault occurs. Induction motors are usually equipped with several types of protection with different operation mechanisms, making it challenging to develop adequate yet not overly complex protection models and determine their parameters for aggregate induction motor models. This paper proposes an optimization-based nonlinear regression framework to determine protection model parameters for aggregate induction motor loads in commercial buildings. Using a mathematical abstraction, the task of determining a suitable set of parameters for the protection model in composite load models is formulated as a nonlinear regression problem. Numerical examples are provided to illustrate the application of the framework. Sensitivity studies are presented to demonstrate the impact of lack of available motor load information on the accuracy of the protection models.

eess.SY↗

arXiv2019

Can Predictive Filters Detect Gradually Ramping False Data Injection Attacks Against PMUs?

Intelligently designed false data injection (FDI) attacks have been shown to be able to bypass the $\chi^2$-test based bad data detector (BDD), resulting in physical consequences (such as line overloads) in the power system. In this paper, it is shown that if an attack is suddenly injected into the system, a predictive filter with sufficient accuracy is able to detect it. However, an attacker can gradually increase the magnitude of the attack to avoid detection, and still cause damage to the system.

eess.SY↗

arXiv2019

Vulnerability Assessment of N-1 Reliable Power Systems to False Data Injection Attacks

This paper studies the vulnerability of large-scale power systems to false data injection (FDI) attacks through their physical consequences. Prior work has shown that an attacker-defender bi-level linear program (ADBLP) can be used to determine the worst-case consequences of FDI attacks aiming to maximize the physical power flow on a target line. Understanding the consequences of these attacks requires consideration of power system operations commonly used in practice, specifically real-time contingency analysis (RTCA) and security constrained economic dispatch (SCED). An ADBLP is formulated with detailed assumptions on attacker's knowledge, and a modified Benders' decomposition algorithm is introduced to solve such an ADBLP. The vulnerability analysis results presented for the synthetic Texas system with 2000 buses show that intelligent FDI attacks can cause post-contingency overflows.

eess.SY↗

arXiv2018

Unobservable False Data Injection Attacks against PMUs: Feasible Conditions and Multiplicative Attacks

This paper studies false data injection (FDI) attacks against phasor measurement units (PMUs). As compared to the conventional bad data detector (BDD), an enhanced BDD utilizing the effect of zero injection buses is proposed. Feasible conditions under which FDI attacks are unobservable to this enhanced BDD are discussed. In addition, a class of multiplicative FDI attacks that maintain the rank of the PMU measurement matrix is introduced. Simulation results on the IEEE RTS-24-bus system indicate that the these multiplicative unobservable attacks can avoid detection by both the enhanced BDD and a detector based on low-rank decomposition proposed in prior work.

eess.SY↗

arXiv2017

Vulnerability Assessment of Large-scale Power Systems to False Data Injection Attacks

This paper studies the vulnerability of large-scale power systems to false data injection (FDI) attacks through their physical consequences. Prior work has shown that an attacker-defender bi-level linear program (ADBLP) can be used to determine the worst-case consequences of FDI attacks aiming to maximize the physical power flow on a target line. This ADBLP can be transformed into a single-level mixed-integer linear program, but it is hard to solve on large power systems due to numerical difficulties. In this paper, four computationally efficient algorithms are presented to solve the attack optimization problem on large power systems. These algorithms are applied on the IEEE 118-bus system and the Polish system with 2383 buses to conduct vulnerability assessments, and they provide feasible attacks that cause line overflows, as well as upper bounds on the maximal power flow resulting from any attack.

eess.SY↗

arXiv2017

False Data Injection Attacks on Phasor Measurements That Bypass Low-rank Decomposition

This paper studies the vulnerability of phasor measurement units (PMUs) to false data injection (FDI) attacks. Prior work demonstrated that unobservable FDI attacks that can bypass traditional bad data detectors based on measurement residuals can be identified by detector based on low-rank decomposition (LD). In this work, a class of more sophisticated FDI attacks that captures the temporal correlation of PMU data is introduced. Such attacks are designed with a convex optimization problem and can always bypass the LD detector. The vulnerability of this attack model is illustrated on both the IEEE 24-bus RTS and the IEEE 118-bus systems.

eess.SY↗

arXiv2017

Can Attackers with Limited Information Exploit Historical Data to Mount Successful False Data Injection Attacks on Power Systems?

This paper studies physical consequences of unobservable false data injection (FDI) attacks designed only with information inside a sub-network of the power system. The goal of this attack is to overload a chosen target line without being detected via measurements. To overcome the limited information, a multiple linear regression model is developed to learn the relationship between the external network and the attack sub-network from historical data. The worst possible consequences of such FDI attacks are evaluated by solving a bi-level optimization problem wherein the first level models the limited attack resources, while the second level formulates the system response to such attacks via DC optimal power flow (OPF). The attack model with limited information is reflected in the DC OPF formulation that only takes into account the system information for the attack sub-network. The vulnerability of this attack model is illustrated on the IEEE 24-bus RTS and IEEE 118-bus systems.

eess.SY↗

arXiv2016

Evaluating Power System Vulnerability to False Data Injection Attacks via Scalable Optimization

Physical consequences to power systems of false data injection cyber-attacks are considered. Prior work has shown that the worst-case consequences of such an attack can be determined using a bi-level optimization problem, wherein an attack is chosen to maximize the physical power flow on a target line subsequent to re-dispatch. This problem can be solved as a mixed-integer linear program, but it is difficult to scale to large systems due to numerical challenges. Three new computationally efficient algorithms to solve this problem are presented. These algorithms provide lower and upper bounds on the system vulnerability measured as the maximum power flow subsequent to an attack. Using these techniques, vulnerability assessments are conducted for IEEE 118-bus system and Polish system with 2383 buses.

eess.SY↗