Detection of Stealthy Cyber-Physical Line Disconnection Attacks in Smart Grid

This paper considers stealthy cyber-physical attacks in power systems where one or more lines and buses are disconnected by opening their respective switches/circuit breakers and to conceal such attacks, the SCADA and PMU measurements are manipulated stealthily. The paper presents a framework based on the non-linear power flow model to characterize such cyber-physical attacks and proposes a technique that uses switching transients for detecting them. The detection methodology uses the fact that any physical disconnection will cause a notable amount of transients in the system. These transient components measured by the PMUs are used to validate the legitimacy of the steady-state values of SCADA and PMU measurements and detect stealthy line disconnection and bus outage attacks. The proposed technique has been tested on the IEEE 30 bus system and it is shown that it can detect the cyber-physical attacks that conceal multiple line disconnections and bus outages under various load conditions.

I. Introduction

Modern power system networks employ various state-of-the-art information and communication technologies (ICT) to have better monitoring and control operations. The geographical vastness of the network and the inclusion of ICT in its day-to-day operations can make the system prone to a variety of malicious attacks which can be classified as follows: •

Physical attacks aim to change the topological nature of the power system network by targeting components like transmission lines, transformers and generators [1]–[3].

•

Cyber attacks manipulate the measurements corresponding to supervisory control and data acquisition (SCADA) system or phasor measurement units (PMU) such that the current system is misrepresented and can influence wrong decisions from the control center [4]–[6].