The digitalization of power systems over the past decade has made the cybersecurity of substations a top priority for regulatory agencies and utilities. Proprietary communication protocols are being increasingly replaced by standardized and interoperable protocols providing utility operators with remote access and control capabilities at the expense of growing cyberattack risks. In particular, the potential of supply chain cyberattacks is on the rise in industrial control systems. In this environment, there is a pressing need for the development of cyberattack detection systems for substations and in particular protective relays, a critical component of substation operation. This paper presents a deep learning-based cyberattack detection system for transmission line protective relays. The proposed cyberattack detection system is first trained with current and voltage measurements representing various types of faults on the transmission lines. The cyberattack detection system is then employed to detect current and voltage measurements that are maliciously injected by an attacker to trigger the transmission line protective relays. The proposed cyberattack detection system is evaluated under a variety of cyberattack scenarios. The results demonstrate that a universal architecture can be designed for the deep learning-based cyberattack detection systems in substations.

The evolution of power generation systems, along with their related increase in complexity, led to the critical necessity of Wide-Area Monitoring, Protection, and Control (WAMPAC) systems in today’s smart grid. Recent developments in smart measurement devices coupled with data communication technologies allow for significant improvements in power systems’ reliability, efficiency, and security. These technological advancements make WAMPAC systems of significant practical interest. However, the geographically distributed nature of such systems increases the potential attack surface and the risk of critical vulnerabilities. Thus, it is of paramount importance to identify the related threats and vulnerabilities as well as the prominent solutions relevant to WAMPAC systems. Consequently, this paper aims to provide a comprehensive review of WAMPAC security aspects along with the state-of-the-art research initiatives addressing such aspects. Specifically, this paper provides critical taxonomies of the cyber-security scope of WAMPAC that guide the accompanying survey of the recent studies on the WAMPAC security domain. As such, this article aims to pave the way for prospective researchers to pursue further studies in areas that require in-depth investigation into the security, reliability, and efficiency of WAMPAC as the backbone of smart grids.

This paper investigates the possible cyber-physical attacks on voltage stability monitoring of a power transmission system. By considering a smart adversary that can launch a vector attack based on power flow equations, conventional voltage stability monitoring systems based on voltage stability indexes will fail to detect the instability issue. This can mislead the Power System Operator (PSO) to take inappropriate corrective action. In order to prevent and to combat such a malicious attack, a new indicator for efficient intrusion detection and a novel mitigation algorithm is proposed. This proposed detection algorithm employs the multi-port equivalent circuit of the power system to calculate the Thevenin Equivalent (TE) parameters. These TE parameters are then used to calculate an indicator, which reveals the attack on Phasor Measurement Unit (PMU) data. The proposed mitigation scheme then helps PSO to detect which PMU is under-attack. Furthermore, the amount of injected attack vectors is computed or estimated depending on the number of compromised PMUs. The effectiveness of the proposed techniques is demonstrated via illustrative case studies.

The Precision Time Protocol (PTP) is the favorable mechanism to provide unified and precise time at the substation level in the smart grid. PTP was shown to be vulnerable to cyberattacks targeting its components and synchronization services. In this paper, we capitalize on the theory and outcome of our previous work to contribute a more complete solution that addresses PTP cyber security. We propose to close the PTP loop through an extension that introduces new functionality and messages. This extension covers the PTP attack surface and enables the detection of attacks on PTP time synchronization. We formally model and verify the proposed extension using UPPAAL model checker. In addition, we validate the proposed extension using Omnet++ simulation. The evaluation demonstrates that our approach preserves PTP functionality, and successfully detects cyber attacks targeting PTP components in a timely manner.

State estimation is a data processing algorithm for converting redundant meter measurements and other information into an estimate of the state of a power system. Relying heavily on meter measurements, state estimation has proven to be vulnerable to cyber attacks. In this paper, a novel targeted false data injection attack (FDIA) model against AC state estimation is proposed. Leveraging on the intrinsic load dynamics in ambient conditions and important properties of the Ornstein-Uhlenbeck process, we, from the viewpoint of intruders, design an algorithm to extract power network parameters purely from PMU data, which are further used to construct the FDIA vector. Requiring no network parameters and relying only on limited phasor measurement unit (PMU) data, the proposed FDIA model can target specific states and launch large deviation attacks. Sufficient conditions for the proposed FDIA model are also developed. Various attack vectors and attacking regions are studied in the IEEE 39-bus system, showing that the proposed FDIA method can successfully bypass the bad data detection and launch targeted large deviation attacks with very high probabilities.

Microgrids, as a major domain of smart grids, facilitate the integration of distributed and renewable energy sources. They are capable of operating autonomously when the connection to the main grid is difficult or cost-ineffective. As the presence of microgrids in the smart grid becomes more common, it becomes more urgent to protect the microgrid from cyberattacks. In this paper, we present the first design and implementation of a microgrid security monitoring platform based on IEC 62351–7:2017 Network and System Management (NSM). The capabilities of this platform are demonstrated on a detailed microgrid model that is deployed on a real-time co-simulation testbed. A hybrid rule-based and machine learning anomaly detection approach is developed to detect attacks targeting the microgrid. To investigate the effectiveness of the NSM security monitoring platform, evaluate the proposed detection schemes, and observe the impact of cyberattacks on the microgrid operation, several formulated attacks against the microgrid are simulated. The effectiveness of different parameters and architectures for the anomaly detection schemes are compared against one another, including Long Short-Term Memory (LSTM) and Gated Recurrent Unit (GRU). The obtained results demonstrate the strengths and gaps of security monitoring based on NSM, and can be seen as first step towards the design of more comprehensive monitoring platforms that integrate NSM along with complementary mechanisms such as passive network traffic inspection and device log analysis.