Sequential-Mining-Based Vulnerable Branches Identification for the Transmission Network Under Continuous Load Redistribution Attacks

Load redistribution (LR) attacks represent a major cyber threat to the power grid that can result in branch overloads and even cascading failures in the transmission network by injecting false data to load bus power injection and line power flow measurements. While the mechanism and defense strategies have been well studied for single-occurrence (i.e., discrete) LR attacks, this paper focuses on a yet unexplored category of LR attacks, namely, the continuous LR (CLR) attack, which continuously injects time-varying false data to one or more bus and branch measurements within the system for a certain period of time. To cope with the potentially ever-changing targeted branches (i.e., the branches under attack) and system vulnerability features caused by CLR attacks, this paper takes a different route from the traditional LR defense and mitigation approaches. We propose a novel correlation chain model to capture the vulnerability correlations among branches under the CLR attack. Then, a dynamic sequential-mining algorithm (DSMA) with top-k structure is proposed based on the specific nature of the CLR attack, to mine the historical SCADA measurement database, extract vulnerable branch sequences, and identify the most suitable branches to defend preventively. Simulation studies are conducted on IEEE RTS-96 system to evaluate the effectiveness of the proposed approach in terms of increasing attack costs for the attackers and reducing the potential impacts of CLR attacks.