This paper investigates the possible cyber-physical attacks on voltage stability monitoring of a power transmission system. By considering a smart adversary that can launch a vector attack based on power flow equations, conventional voltage stability monitoring systems based on voltage stability indexes will fail to detect the instability issue. This can mislead the Power System Operator (PSO) to take inappropriate corrective action. In order to prevent and to combat such a malicious attack, a new indicator for efficient intrusion detection and a novel mitigation algorithm is proposed. This proposed detection algorithm employs the multi-port equivalent circuit of the power system to calculate the Thevenin Equivalent (TE) parameters. These TE parameters are then used to calculate an indicator, which reveals the attack on Phasor Measurement Unit (PMU) data. The proposed mitigation scheme then helps PSO to detect which PMU is under-attack. Furthermore, the amount of injected attack vectors is computed or estimated depending on the number of compromised PMUs. The effectiveness of the proposed techniques is demonstrated via illustrative case studies.

The Precision Time Protocol (PTP) is the favorable mechanism to provide unified and precise time at the substation level in the smart grid. PTP was shown to be vulnerable to cyberattacks targeting its components and synchronization services. In this paper, we capitalize on the theory and outcome of our previous work to contribute a more complete solution that addresses PTP cyber security. We propose to close the PTP loop through an extension that introduces new functionality and messages. This extension covers the PTP attack surface and enables the detection of attacks on PTP time synchronization. We formally model and verify the proposed extension using UPPAAL model checker. In addition, we validate the proposed extension using Omnet++ simulation. The evaluation demonstrates that our approach preserves PTP functionality, and successfully detects cyber attacks targeting PTP components in a timely manner.

According to the IEC 62351-7 standard, data collection using network and system management (NSM) can be used to support the security monitoring of the smart grid. In this article, an NSM security monitoring platform for a realistic IEC 61850 substation model is developed using the specifications provided in IEC 62351-7. In the developed model, grid measurements are ready to take operative decisions, whereas collected NSM data are leveraged to detect cyberattacks and/or identify anomalies. The model includes power components (e.g., transformers, lines, and generators), controllers (e.g., voltage control), protection devices (e.g., overcurrent, distance, differential, and under/overvoltage), communication protocols (e.g., sampled value and generic object-oriented substation event), and NSM (e.g., agents and managers) applications. Moreover, a two-step deep learning framework is proposed for anomaly detection and cyberattack identification with enhanced accuracy. The first step can apply long short-term memory, recurrent neural network, and gated recurrent units, each in combination with an autoencoder. Then, the ensemble learning technique is used in the second step to augment the outputs of these deep learning models. To evaluate the effectiveness of the proposed cyberattack and anomaly detection framework, we detail and simulate potential cyberattacks targeting the performance of the IEEE 9-bus system. The proposed anomaly detection scheme can identify these threats using NSM data in a hardware-in-the-loop testbed. Finally, based on our assessment results, recommendations are provided for cybersecurity guidelines concerning IEC 62351-7.